Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2021-22959
Vulnerability from cvelistv5
Published
2021-11-15 14:45
Modified
2024-08-03 18:58
Severity ?
EPSS score ?
Summary
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
References
▼ | URL | Tags | |
---|---|---|---|
support@hackerone.com | https://hackerone.com/reports/1238709 | Exploit, Issue Tracking, Third Party Advisory | |
support@hackerone.com | https://www.debian.org/security/2022/dsa-5170 | Mailing List, Third Party Advisory | |
support@hackerone.com | https://www.oracle.com/security-alerts/cpujan2022.html | Patch, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://hackerone.com/reports/1238709 | Exploit, Issue Tracking, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.debian.org/security/2022/dsa-5170 | Mailing List, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://www.oracle.com/security-alerts/cpujan2022.html | Patch, Third Party Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | n/a | https://github.com/nodejs/llhttp |
Version: Fixed in llhttp v2.1.4 and v6.0.6 |
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T18:58:26.156Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://hackerone.com/reports/1238709" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "name": "DSA-5170", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2022/dsa-5170" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "https://github.com/nodejs/llhttp", "vendor": "n/a", "versions": [ { "status": "affected", "version": "Fixed in llhttp v2.1.4 and v6.0.6" } ] } ], "descriptions": [ { "lang": "en", "value": "The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp \u003c v2.1.4 and \u003c v6.0.6." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-444", "description": "HTTP Request Smuggling (CWE-444)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-06-28T10:06:15", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://hackerone.com/reports/1238709" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "name": "DSA-5170", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2022/dsa-5170" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "support@hackerone.com", "ID": "CVE-2021-22959", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "https://github.com/nodejs/llhttp", "version": { "version_data": [ { "version_value": "Fixed in llhttp v2.1.4 and v6.0.6" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp \u003c v2.1.4 and \u003c v6.0.6." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "HTTP Request Smuggling (CWE-444)" } ] } ] }, "references": { "reference_data": [ { "name": "https://hackerone.com/reports/1238709", "refsource": "MISC", "url": "https://hackerone.com/reports/1238709" }, { "name": "https://www.oracle.com/security-alerts/cpujan2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "name": "DSA-5170", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2022/dsa-5170" } ] } } } }, "cveMetadata": { "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2021-22959", "datePublished": "2021-11-15T14:45:16", "dateReserved": "2021-01-06T00:00:00", "dateUpdated": "2024-08-03T18:58:26.156Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2021-22959\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2021-11-15T15:15:06.747\",\"lastModified\":\"2024-11-21T05:51:01.317\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp \u003c v2.1.4 and \u003c v6.0.6.\"},{\"lang\":\"es\",\"value\":\"El parser en acepta peticiones con un espacio (SP) justo despu\u00e9s del nombre del encabezado antes de los dos puntos. Esto puede conllevar a un contrabando de peticiones HTTP (HRS) en llhttp versiones anteriores a v2.1.4 y versiones anteriores a v6.0.6\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:N\",\"baseScore\":6.4,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"2.1.4\",\"matchCriteriaId\":\"6B7CB576-CA48-462E-A360-6CE14FADCC6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"6.0.6\",\"matchCriteriaId\":\"AF1511BB-A1F0-4AF9-80C3-5EB6317F8525\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:graalvm:20.3.4:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"9F300E13-1B40-4B35-ACA5-4D402CD41055\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:graalvm:21.3.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"B10E38A6-783C-45A2-98A1-12FA1EB3D3AA\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://hackerone.com/reports/1238709\",\"source\":\"support@hackerone.com\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2022/dsa-5170\",\"source\":\"support@hackerone.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2022.html\",\"source\":\"support@hackerone.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://hackerone.com/reports/1238709\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2022/dsa-5170\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}" } }
rhea-2022_5139
Vulnerability from csaf_redhat
Published
2022-06-21 12:40
Modified
2024-12-17 22:55
Summary
Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.
Details
Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.
Bug Fix(es) and Enhancement(s):
* nodejs:12/nodejs: rebase to last upstream release (BZ#2084651)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable\nnetwork applications in the JavaScript programming language.\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:12/nodejs: rebase to last upstream release (BZ#2084651)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHEA-2022:5139", "url": "https://access.redhat.com/errata/RHEA-2022:5139" }, { "category": "external", "summary": "2084651", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084651" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhea-2022_5139.json" } ], "title": "Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update", "tracking": { "current_release_date": "2024-12-17T22:55:22+00:00", "generator": { "date": "2024-12-17T22:55:22+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHEA-2022:5139", "initial_release_date": "2022-06-21T12:40:06+00:00", "revision_history": [ { "date": "2022-06-21T12:40:06+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-21T12:40:06+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T22:55:22+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8060020220523160029:ad008a3a", "product": { "name": "nodejs:12:8060020220523160029:ad008a3a", "product_id": "nodejs:12:8060020220523160029:ad008a3a", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8060020220523160029:ad008a3a" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "product": { "name": "nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "product_id": "nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product_id": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.3-1.module%2Bel8.4.0%2B11732%2Bc668cc9f?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "product": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "product_id": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product_id": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.3-1.module%2Bel8.4.0%2B11732%2Bc668cc9f?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.6.0%2B15324%2B1f2c5d8d?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, "product_reference": "nodejs:12:8060020220523160029:ad008a3a", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch" }, "product_reference": "nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src" }, "product_reference": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64 as a component of nodejs:12:8060020220523160029:ad008a3a as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-21T12:40:06+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5139" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debuginfo-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-debugsource-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-devel-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-docs-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-full-i18n-1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d.x86_64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.aarch64", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.ppc64le", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.s390x", "AppStream-8.6.0.Z.MAIN.EUS:nodejs:12:8060020220523160029:ad008a3a:npm-1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" } ] }
rhsa-2022_0041
Vulnerability from csaf_redhat
Published
2022-01-06 18:43
Modified
2024-12-17 22:54
Summary
Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
Notes
Topic
An update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: rh-nodejs14-nodejs (14.18.2). (BZ#2031766)
Security Fix(es):
* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)
* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)
* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)
* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: rh-nodejs14-nodejs (14.18.2). (BZ#2031766)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:0041", "url": "https://access.redhat.com/errata/RHSA-2022:0041" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "2007557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007557" }, { "category": "external", "summary": "2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "2031766", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031766" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0041.json" } ], "title": "Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update", "tracking": { "current_release_date": "2024-12-17T22:54:11+00:00", "generator": { "date": "2024-12-17T22:54:11+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2022:0041", "initial_release_date": "2022-01-06T18:43:03+00:00", "revision_history": [ { "date": "2022-01-06T18:43:03+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-01-06T18:43:03+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T22:54:11+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for RHEL(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "product": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "product_id": "rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.18.2-1.el7?arch=src" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "product": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "product_id": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-nodemon@2.0.3-6.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "product_id": "rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.18.2-1.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "product_id": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.18.2-1.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "product": { "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "product_id": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.15-14.18.2.1.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.18.2-1.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "product": { "name": "rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "product_id": "rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-docs@14.18.2-1.el7?arch=noarch" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "product": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "product_id": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-nodemon@2.0.3-6.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "product_id": "rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.18.2-1.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "product_id": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.18.2-1.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "product": { "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "product_id": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.15-14.18.2.1.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.18.2-1.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs@14.18.2-1.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-devel@14.18.2-1.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "product": { "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "product_id": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-npm@6.14.15-14.18.2.1.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "product": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "product_id": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs14-nodejs-debuginfo@14.18.2-1.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src" }, "product_reference": "rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le" }, "product_reference": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x" }, "product_reference": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" }, "product_reference": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src" }, "product_reference": "rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64" }, "product_reference": "rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src" }, "product_reference": "rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le" }, "product_reference": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x" }, "product_reference": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" }, "product_reference": "rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3807", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-09-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2007557" } ], "notes": [ { "category": "description", "text": "A regular expression denial of service (ReDoS) vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw requires crafted invalid ANSI escape codes in order to be exploited and only allows for denial of service of applications on the client side, hence the impact has been rated as Moderate.\n\nIn Red Hat Virtualization and Red Hat Quay some components use a vulnerable version of ansi-regex. However, all frontend code is executed on the client side. As the maximum impact of this vulnerability is denial of service in the client, the vulnerability is rated Moderate for those products.\n\nOpenShift Container Platform 4 (OCP) ships affected version of ansi-regex in the ose-metering-hadoop container, however the metering operator is deprecated since 4.6[1]. This issue is not currently planned to be addressed in future updates and hence hadoop container has been marked as \u0027will not fix\u0027.\n\nAdvanced Cluster Management for Kubernetes (RHACM) ships the affected version of ansi-regex in several containers, however the impact of this vulnerability is deemed low as it would result in an authenticated slowing down their own user interface. \n\n[1] https://docs.openshift.com/container-platform/4.6/metering/metering-about-metering.html", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3807" }, { "category": "external", "summary": "RHBZ#2007557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007557" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3807", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3807" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3807", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3807" }, { "category": "external", "summary": "https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994", "url": "https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994" } ], "release_date": "2021-09-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-06T18:43:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes" }, { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-06T18:43:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-06T18:43:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-06T18:43:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-06T18:43:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-06T18:43:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0041" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-debuginfo-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-devel-0:14.18.2-1.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-docs-0:14.18.2-1.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs14-nodejs-nodemon-0:2.0.3-6.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs14-npm-0:6.14.15-14.18.2.1.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" } ] }
rhea-2022_5221
Vulnerability from csaf_redhat
Published
2022-06-28 07:58
Modified
2024-12-17 22:55
Summary
Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Bug Fix(es) and Enhancement(s):
* nodejs:12/nodejs: rebase to last upstream release (BZ#2084653)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:12/nodejs: rebase to last upstream release (BZ#2084653)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHEA-2022:5221", "url": "https://access.redhat.com/errata/RHEA-2022:5221" }, { "category": "external", "summary": "2084653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084653" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhea-2022_5221.json" } ], "title": "Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update", "tracking": { "current_release_date": "2024-12-17T22:55:12+00:00", "generator": { "date": "2024-12-17T22:55:12+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHEA-2022:5221", "initial_release_date": "2022-06-28T07:58:19+00:00", "revision_history": [ { "date": "2022-06-28T07:58:19+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-28T07:58:19+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T22:55:12+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.2::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8020020220523154454:4cda2c84", "product": { "name": "nodejs:12:8020020220523154454:4cda2c84", "product_id": "nodejs:12:8020020220523154454:4cda2c84", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8020020220523154454:4cda2c84" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "product": { "name": "nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "product_id": "nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "product": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "product_id": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.2.0%2B15322%2Ba70ca0ab?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, "product_reference": "nodejs:12:8020020220523154454:4cda2c84", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch" }, "product_reference": "nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64 as a component of nodejs:12:8020020220523154454:4cda2c84 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-28T07:58:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5221" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debuginfo-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-debugsource-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-devel-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-docs-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-full-i18n-1:12.22.12-1.module+el8.2.0+15322+a70ca0ab.x86_64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.aarch64", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.ppc64le", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.s390x", "AppStream-8.2.0.Z.EUS:nodejs:12:8020020220523154454:4cda2c84:npm-1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" } ] }
rhea-2022_5615
Vulnerability from csaf_redhat
Published
2022-07-19 21:07
Modified
2024-12-17 22:55
Summary
Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Bug Fix(es) and Enhancement(s):
* nodejs:12/nodejs: rebase to last upstream release (BZ#2084652)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:12/nodejs: rebase to last upstream release (BZ#2084652)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHEA-2022:5615", "url": "https://access.redhat.com/errata/RHEA-2022:5615" }, { "category": "external", "summary": "2084652", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084652" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhea-2022_5615.json" } ], "title": "Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update", "tracking": { "current_release_date": "2024-12-17T22:55:03+00:00", "generator": { "date": "2024-12-17T22:55:03+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHEA-2022:5615", "initial_release_date": "2022-07-19T21:07:21+00:00", "revision_history": [ { "date": "2022-07-19T21:07:21+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-07-19T21:07:21+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T22:55:03+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.4::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8040020220523155137:522a0ee4", "product": { "name": "nodejs:12:8040020220523155137:522a0ee4", "product_id": "nodejs:12:8040020220523155137:522a0ee4", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8040020220523155137:522a0ee4" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "product": { "name": "nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "product_id": "nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product_id": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.3-1.module%2Bel8.4.0%2B11732%2Bc668cc9f?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "product": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "product_id": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product_id": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.3-1.module%2Bel8.4.0%2B11732%2Bc668cc9f?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.4.0%2B15323%2B4d1cc445?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, "product_reference": "nodejs:12:8040020220523155137:522a0ee4", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch" }, "product_reference": "nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src" }, "product_reference": "nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64 as a component of nodejs:12:8040020220523155137:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-07-19T21:07:21+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:5615" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debuginfo-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-debugsource-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-devel-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-docs-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-full-i18n-1:12.22.12-1.module+el8.4.0+15323+4d1cc445.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-nodemon-0:2.0.3-1.module+el8.4.0+11732+c668cc9f.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.s390x", "AppStream-8.4.0.Z.EUS:nodejs:12:8040020220523155137:522a0ee4:npm-1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" } ] }
rhsa-2022_4914
Vulnerability from csaf_redhat
Published
2022-06-06 09:29
Modified
2024-12-17 22:55
Summary
Red Hat Security Advisory: rh-nodejs12-nodejs security, bug fix, and enhancement update
Notes
Topic
An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.22.12). This is the last planned rebase before the collection reaches End of Life.
Security Fix(es):
* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)
* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
* minimist: prototype pollution (CVE-2021-44906)
* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)
* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)
* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.22.12). This is the last planned rebase before the collection reaches End of Life.\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:4914", "url": "https://access.redhat.com/errata/RHSA-2022:4914" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4914.json" } ], "title": "Red Hat Security Advisory: rh-nodejs12-nodejs security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-12-17T22:55:06+00:00", "generator": { "date": "2024-12-17T22:55:06+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2022:4914", "initial_release_date": "2022-06-06T09:29:16+00:00", "revision_history": [ { "date": "2022-06-06T09:29:16+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-06T09:29:16+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T22:55:06+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } }, { "category": "product_name", "name": "Red Hat Software Collections for RHEL(v. 7)", "product": { "name": "Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7" } } } ], "category": "product_family", "name": "Red Hat Software Collections" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "product": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "product_id": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.22.12-2.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "product_id": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.22.12-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "product_id": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.22.12-2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "product": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "product_id": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.16-12.22.12.2.el7?arch=x86_64" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.22.12-2.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "product": { "name": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "product_id": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-docs@12.22.12-2.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "product_id": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.22.12-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "product_id": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.22.12-2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "product": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "product_id": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.16-12.22.12.2.el7?arch=s390x" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.22.12-2.el7?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs@12.22.12-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-devel@12.22.12-2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "product": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "product_id": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-npm@6.14.16-12.22.12.2.el7?arch=ppc64le" } } }, { "category": "product_version", "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "product": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "product_id": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-nodejs12-nodejs-debuginfo@12.22.12-2.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)", "product_id": "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "relates_to_product_reference": "7Server-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64" }, "product_reference": "rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch" }, "product_reference": "rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "relates_to_product_reference": "7Workstation-RHSCL-3.8" }, { "category": "default_component_of", "full_product_name": { "name": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)", "product_id": "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" }, "product_reference": "rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "relates_to_product_reference": "7Workstation-RHSCL-3.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-06T09:29:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:4914" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Server-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Server-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.src", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-debuginfo-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-devel-0:12.22.12-2.el7.x86_64", "7Workstation-RHSCL-3.8:rh-nodejs12-nodejs-docs-0:12.22.12-2.el7.noarch", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.ppc64le", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.s390x", "7Workstation-RHSCL-3.8:rh-nodejs12-npm-0:6.14.16-12.22.12.2.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" } ] }
rhea-2022_4925
Vulnerability from csaf_redhat
Published
2022-06-07 08:24
Modified
2024-12-17 22:54
Summary
Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update
Notes
Topic
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.
Details
Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.
Bug Fix(es) and Enhancement(s):
* nodejs:12/nodejs: rebase to last upstream release (BZ#2084654)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable\nnetwork applications in the JavaScript programming language.\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:12/nodejs: rebase to last upstream release (BZ#2084654)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHEA-2022:4925", "url": "https://access.redhat.com/errata/RHEA-2022:4925" }, { "category": "external", "summary": "2084654", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084654" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhea-2022_4925.json" } ], "title": "Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update", "tracking": { "current_release_date": "2024-12-17T22:54:54+00:00", "generator": { "date": "2024-12-17T22:54:54+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHEA-2022:4925", "initial_release_date": "2022-06-07T08:24:22+00:00", "revision_history": [ { "date": "2022-06-07T08:24:22+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-06-07T08:24:22+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T22:54:54+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product": { "name": "Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_e4s:8.1::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:12:8010020220518102644:c27ad7f8", "product": { "name": "nodejs:12:8010020220518102644:c27ad7f8", "product_id": "nodejs:12:8010020220518102644:c27ad7f8", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@12:8010020220518102644:c27ad7f8" } } }, { "category": "product_version", "name": "nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "product": { "name": "nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "product_id": "nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "product": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "product_id": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@1.18.3-1.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_id": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@17-3.module%2Bel8.1.0%2B3369%2B37ae6a45?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@12.22.12-1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64", "product": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_id": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.16-1.12.22.12.1.module%2Bel8.1.0%2B15296%2B87b2f6ad?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, "product_reference": "nodejs:12:8010020220518102644:c27ad7f8", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch" }, "product_reference": "nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src" }, "product_reference": "nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64 as a component of nodejs:12:8010020220518102644:c27ad7f8 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.1)", "product_id": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" }, "product_reference": "npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-44531", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040839" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js where it accepted a certificate\u0027s Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Improper handling of URI Subject Alternative Names", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44531" }, { "category": "external", "summary": "RHBZ#2040839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44531" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Improper handling of URI Subject Alternative Names" }, { "cve": "CVE-2021-44532", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040846" } ], "notes": [ { "category": "description", "text": "It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Certificate Verification Bypass via String Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44532" }, { "category": "external", "summary": "RHBZ#2040846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040846" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44532", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44532" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44532" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Certificate Verification Bypass via String Injection" }, { "cve": "CVE-2021-44533", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040856" } ], "notes": [ { "category": "description", "text": "A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Incorrect handling of certificate subject and issuer fields", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally, there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore, the Quay component is marked as \"Will not fix\" with impact LOW.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44533" }, { "category": "external", "summary": "RHBZ#2040856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040856" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44533", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44533" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44533" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs: Incorrect handling of certificate subject and issuer fields" }, { "cve": "CVE-2022-21824", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2022-01-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2040862" } ], "notes": [ { "category": "description", "text": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js \u003e= 12.22.9, \u003e= 14.18.3, \u003e= 16.13.2, and \u003e= 17.3.1 use a null protoype for the object these properties are being assigned to.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs: Prototype pollution via console.table properties", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-21824" }, { "category": "external", "summary": "RHBZ#2040862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2040862" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21824", "url": "https://www.cve.org/CVERecord?id=CVE-2022-21824" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21824" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/" } ], "release_date": "2022-01-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-06-07T08:24:22+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHEA-2022:4925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debuginfo-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-debugsource-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-devel-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-docs-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-full-i18n-1:12.22.12-1.module+el8.1.0+15296+87b2f6ad.x86_64", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-nodemon-0:1.18.3-1.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.noarch", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:nodejs-packaging-0:17-3.module+el8.1.0+3369+37ae6a45.src", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.ppc64le", "AppStream-8.1.0.Z.E4S:nodejs:12:8010020220518102644:c27ad7f8:npm-1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs: Prototype pollution via console.table properties" } ] }
rhsa-2022_0350
Vulnerability from csaf_redhat
Published
2022-02-01 21:18
Modified
2024-12-17 22:54
Summary
Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)
Security Fix(es):
* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)
* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
* normalize-url: ReDoS for data URLs (CVE-2021-33502)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)
* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)
* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:0350", "url": "https://access.redhat.com/errata/RHSA-2022:0350" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "1945459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1945459" }, { "category": "external", "summary": "1964461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1964461" }, { "category": "external", "summary": "1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "2007557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007557" }, { "category": "external", "summary": "2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0350.json" } ], "title": "Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-12-17T22:54:28+00:00", "generator": { "date": "2024-12-17T22:54:28+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2022:0350", "initial_release_date": "2022-02-01T21:18:22+00:00", "revision_history": [ { "date": "2022-02-01T21:18:22+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-02-01T21:18:22+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T22:54:28+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:14:8050020211213115342:c5368500", "product": { "name": "nodejs:14:8050020211213115342:c5368500", "product_id": "nodejs:14:8050020211213115342:c5368500", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@14:8050020211213115342:c5368500" } } }, { "category": "product_version", "name": "nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "product": { "name": "nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "product_id": "nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "product": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "product_id": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.15-1.module%2Bel8.5.0%2B13504%2Ba2e74d91?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product": { "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_id": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_id": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_id": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product": { "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_id": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_id": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "product": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_id": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.15-1.14.18.2.2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "product": { "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "product_id": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "product": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "product_id": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.15-1.module%2Bel8.5.0%2B13504%2Ba2e74d91?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product": { "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product_id": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product_id": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product_id": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product": { "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product_id": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product_id": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "product": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "product_id": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.15-1.14.18.2.2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product": { "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product_id": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product_id": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product_id": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product": { "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product_id": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product_id": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "product": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "product_id": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.15-1.14.18.2.2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product": { "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product_id": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product_id": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product_id": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product": { "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product_id": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product_id": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.18.2-2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64", "product": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64", "product_id": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.15-1.14.18.2.2.module%2Bel8.5.0%2B13644%2B8d46dafd?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, "product_reference": "nodejs:14:8050020211213115342:c5368500", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64" }, "product_reference": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le" }, "product_reference": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x" }, "product_reference": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src" }, "product_reference": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64" }, "product_reference": "nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64" }, "product_reference": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le" }, "product_reference": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x" }, "product_reference": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64" }, "product_reference": "nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64" }, "product_reference": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le" }, "product_reference": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x" }, "product_reference": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64" }, "product_reference": "nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64" }, "product_reference": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le" }, "product_reference": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x" }, "product_reference": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64" }, "product_reference": "nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch" }, "product_reference": "nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64" }, "product_reference": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le" }, "product_reference": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x" }, "product_reference": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64" }, "product_reference": "nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src" }, "product_reference": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64" }, "product_reference": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le" }, "product_reference": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x" }, "product_reference": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64 as a component of nodejs:14:8050020211213115342:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" }, "product_reference": "npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7788", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-12-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1907444" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ini: Prototype pollution via malicious INI file", "title": "Vulnerability summary" }, { "category": "other", "text": "Node.JS packages in Red Hat Enterprise Linux and Red Hat Software Collections included the vulnerable dependency packaged in \"nodejs-npm\" component. Processing malicious files using npm could potentially trigger this vulnerability. The \"ini\" package bundled with npm was not in the library path where it could be included directly in other programs.\n\nThe nodejs-nodemon packages in Red Hat Enterprise Linux and Red Hat Software Collections are affected by this vulnerability as they bundle the nodejs-ini library. Usage of that library is governed by nodemon itself, so applications started by nodemon are not impacted. Further, nodemon is a developer tool not intended to be used in production.\n\nThe ini package is included in Red Hat Quay by protractor and webpack-cli, both of which are dev dependencies.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7788" }, { "category": "external", "summary": "RHBZ#1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7788", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7788" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788" } ], "release_date": "2020-12-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-02-01T21:18:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0350" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ini: Prototype pollution via malicious INI file" }, { "cve": "CVE-2020-28469", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1945459" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-glob-parent. The enclosure regex used to check for glob enclosures containing backslashes is vulnerable to Regular Expression Denial of Service attacks. This flaw allows an attacker to cause a denial of service if they can supply a malicious string to the glob-parent function. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-glob-parent: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "While some components do package a vulnerable version of glob-parent, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:\n - OpenShift Container Platform (OCP)\n - OpenShift ServiceMesh (OSSM)\n - Red Hat Advanced Cluster Management for Kubernetes (RHACM)\n - OpenShift distributed tracing", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-28469" }, { "category": "external", "summary": "RHBZ#1945459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1945459" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28469", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28469" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28469", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28469" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905", "url": "https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905" } ], "release_date": "2021-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-02-01T21:18:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0350" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-glob-parent: Regular expression denial of service" }, { "cve": "CVE-2021-3807", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-09-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2007557" } ], "notes": [ { "category": "description", "text": "A regular expression denial of service (ReDoS) vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw requires crafted invalid ANSI escape codes in order to be exploited and only allows for denial of service of applications on the client side, hence the impact has been rated as Moderate.\n\nIn Red Hat Virtualization and Red Hat Quay some components use a vulnerable version of ansi-regex. However, all frontend code is executed on the client side. As the maximum impact of this vulnerability is denial of service in the client, the vulnerability is rated Moderate for those products.\n\nOpenShift Container Platform 4 (OCP) ships affected version of ansi-regex in the ose-metering-hadoop container, however the metering operator is deprecated since 4.6[1]. This issue is not currently planned to be addressed in future updates and hence hadoop container has been marked as \u0027will not fix\u0027.\n\nAdvanced Cluster Management for Kubernetes (RHACM) ships the affected version of ansi-regex in several containers, however the impact of this vulnerability is deemed low as it would result in an authenticated slowing down their own user interface. \n\n[1] https://docs.openshift.com/container-platform/4.6/metering/metering-about-metering.html", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3807" }, { "category": "external", "summary": "RHBZ#2007557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007557" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3807", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3807" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3807", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3807" }, { "category": "external", "summary": "https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994", "url": "https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994" } ], "release_date": "2021-09-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-02-01T21:18:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0350" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes" }, { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-02-01T21:18:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0350" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-02-01T21:18:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0350" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-02-01T21:18:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0350" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-33502", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-05-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1964461" } ], "notes": [ { "category": "description", "text": "A flaw was found in normalize-url. Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-normalize-url: ReDoS for data URLs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-33502" }, { "category": "external", "summary": "RHBZ#1964461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1964461" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-33502", "url": "https://www.cve.org/CVERecord?id=CVE-2021-33502" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-33502", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33502" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539", "url": "https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539" } ], "release_date": "2021-05-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-02-01T21:18:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0350" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-normalize-url: ReDoS for data URLs" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-02-01T21:18:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0350" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-02-01T21:18:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0350" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debuginfo-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-debugsource-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-devel-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-docs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-full-i18n-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13504+a2e74d91.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:14:8050020211213115342:c5368500:npm-1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" } ] }
rhsa-2022_0246
Vulnerability from csaf_redhat
Published
2022-01-25 09:28
Modified
2024-12-17 22:54
Summary
Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027608)
Security Fix(es):
* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)
* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
* normalize-url: ReDoS for data URLs (CVE-2021-33502)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)
* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)
* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027608)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2022:0246", "url": "https://access.redhat.com/errata/RHSA-2022:0246" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "1945459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1945459" }, { "category": "external", "summary": "1964461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1964461" }, { "category": "external", "summary": "1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "2007557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007557" }, { "category": "external", "summary": "2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0246.json" } ], "title": "Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-12-17T22:54:19+00:00", "generator": { "date": "2024-12-17T22:54:19+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2022:0246", "initial_release_date": "2022-01-25T09:28:51+00:00", "revision_history": [ { "date": "2022-01-25T09:28:51+00:00", "number": "1", "summary": "Initial version" }, { "date": "2022-01-25T09:28:51+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T22:54:19+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.4::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:14:8040020211213111158:522a0ee4", "product": { "name": "nodejs:14:8040020211213111158:522a0ee4", "product_id": "nodejs:14:8040020211213111158:522a0ee4", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@14:8040020211213111158:522a0ee4" } } }, { "category": "product_version", "name": "nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "product": { "name": "nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "product_id": "nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "product": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "product_id": "nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.15-1.module%2Bel8.4.0%2B13503%2Bfc29810b?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product": { "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_id": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_id": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_id": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product": { "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_id": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_id": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "product": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_id": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.15-1.14.18.2.2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "product": { "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "product_id": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "product": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "product_id": "nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.15-1.module%2Bel8.4.0%2B13503%2Bfc29810b?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@23-3.module%2Bel8.3.0%2B6519%2B9f98ed83?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product": { "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_id": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_id": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_id": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product": { "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_id": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_id": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_id": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.15-1.14.18.2.2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product": { "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product_id": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product_id": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product_id": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product": { "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product_id": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product_id": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "product": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "product_id": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.15-1.14.18.2.2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product": { "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_id": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_id": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_id": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product": { "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_id": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_id": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@14.18.2-2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64", "product": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_id": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@6.14.15-1.14.18.2.2.module%2Bel8.4.0%2B13643%2B6c0ebf22?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, "product_reference": "nodejs:14:8040020211213111158:522a0ee4", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64" }, "product_reference": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le" }, "product_reference": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x" }, "product_reference": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src" }, "product_reference": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64" }, "product_reference": "nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64" }, "product_reference": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le" }, "product_reference": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x" }, "product_reference": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64" }, "product_reference": "nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64" }, "product_reference": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le" }, "product_reference": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x" }, "product_reference": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64" }, "product_reference": "nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64" }, "product_reference": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le" }, "product_reference": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x" }, "product_reference": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64" }, "product_reference": "nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch" }, "product_reference": "nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64" }, "product_reference": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le" }, "product_reference": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x" }, "product_reference": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64" }, "product_reference": "nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src" }, "product_reference": "nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src" }, "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64" }, "product_reference": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le" }, "product_reference": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x" }, "product_reference": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64 as a component of nodejs:14:8040020211213111158:522a0ee4 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.4)", "product_id": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" }, "product_reference": "npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64", "relates_to_product_reference": "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7788", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-12-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1907444" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ini: Prototype pollution via malicious INI file", "title": "Vulnerability summary" }, { "category": "other", "text": "Node.JS packages in Red Hat Enterprise Linux and Red Hat Software Collections included the vulnerable dependency packaged in \"nodejs-npm\" component. Processing malicious files using npm could potentially trigger this vulnerability. The \"ini\" package bundled with npm was not in the library path where it could be included directly in other programs.\n\nThe nodejs-nodemon packages in Red Hat Enterprise Linux and Red Hat Software Collections are affected by this vulnerability as they bundle the nodejs-ini library. Usage of that library is governed by nodemon itself, so applications started by nodemon are not impacted. Further, nodemon is a developer tool not intended to be used in production.\n\nThe ini package is included in Red Hat Quay by protractor and webpack-cli, both of which are dev dependencies.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7788" }, { "category": "external", "summary": "RHBZ#1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7788", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7788" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788" } ], "release_date": "2020-12-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-25T09:28:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0246" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ini: Prototype pollution via malicious INI file" }, { "cve": "CVE-2020-28469", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1945459" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-glob-parent. The enclosure regex used to check for glob enclosures containing backslashes is vulnerable to Regular Expression Denial of Service attacks. This flaw allows an attacker to cause a denial of service if they can supply a malicious string to the glob-parent function. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-glob-parent: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "While some components do package a vulnerable version of glob-parent, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:\n - OpenShift Container Platform (OCP)\n - OpenShift ServiceMesh (OSSM)\n - Red Hat Advanced Cluster Management for Kubernetes (RHACM)\n - OpenShift distributed tracing", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-28469" }, { "category": "external", "summary": "RHBZ#1945459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1945459" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28469", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28469" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28469", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28469" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905", "url": "https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905" } ], "release_date": "2021-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-25T09:28:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0246" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-glob-parent: Regular expression denial of service" }, { "cve": "CVE-2021-3807", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-09-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2007557" } ], "notes": [ { "category": "description", "text": "A regular expression denial of service (ReDoS) vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw requires crafted invalid ANSI escape codes in order to be exploited and only allows for denial of service of applications on the client side, hence the impact has been rated as Moderate.\n\nIn Red Hat Virtualization and Red Hat Quay some components use a vulnerable version of ansi-regex. However, all frontend code is executed on the client side. As the maximum impact of this vulnerability is denial of service in the client, the vulnerability is rated Moderate for those products.\n\nOpenShift Container Platform 4 (OCP) ships affected version of ansi-regex in the ose-metering-hadoop container, however the metering operator is deprecated since 4.6[1]. This issue is not currently planned to be addressed in future updates and hence hadoop container has been marked as \u0027will not fix\u0027.\n\nAdvanced Cluster Management for Kubernetes (RHACM) ships the affected version of ansi-regex in several containers, however the impact of this vulnerability is deemed low as it would result in an authenticated slowing down their own user interface. \n\n[1] https://docs.openshift.com/container-platform/4.6/metering/metering-about-metering.html", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3807" }, { "category": "external", "summary": "RHBZ#2007557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007557" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3807", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3807" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3807", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3807" }, { "category": "external", "summary": "https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994", "url": "https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994" } ], "release_date": "2021-09-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-25T09:28:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0246" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes" }, { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-25T09:28:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0246" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-25T09:28:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0246" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-25T09:28:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0246" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-33502", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-05-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1964461" } ], "notes": [ { "category": "description", "text": "A flaw was found in normalize-url. Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-normalize-url: ReDoS for data URLs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-33502" }, { "category": "external", "summary": "RHBZ#1964461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1964461" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-33502", "url": "https://www.cve.org/CVERecord?id=CVE-2021-33502" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-33502", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33502" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539", "url": "https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539" } ], "release_date": "2021-05-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-25T09:28:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0246" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-normalize-url: ReDoS for data URLs" }, { "cve": "CVE-2021-37701", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999731" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on directories. This flaw allows an untrusted tar file to extract and overwrite files into an arbitrary location. A similar confusion can arise on case-insensitive filesystems. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37701" }, { "category": "external", "summary": "RHBZ#1999731", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999731" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37701", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37701" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37701" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1779", "url": "https://www.npmjs.com/advisories/1779" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-25T09:28:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0246" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" }, { "cve": "CVE-2021-37712", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2021-08-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1999739" } ], "notes": [ { "category": "description", "text": "A flaw was found in the npm package \"tar\" (aka node-tar). Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an untrusted tar file to extract and overwrite files into an arbitrary location. The highest threat from this vulnerability is to integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed `node-tar` in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-37712" }, { "category": "external", "summary": "RHBZ#1999739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999739" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37712", "url": "https://www.cve.org/CVERecord?id=CVE-2021-37712" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37712" }, { "category": "external", "summary": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p", "url": "https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1780", "url": "https://www.npmjs.com/advisories/1780" } ], "release_date": "2021-08-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2022-01-25T09:28:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2022:0246" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debuginfo-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-debugsource-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-devel-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-docs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-full-i18n-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.x86_64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-nodemon-0:2.0.15-1.module+el8.4.0+13503+fc29810b.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.aarch64", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.ppc64le", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.s390x", "AppStream-8.4.0.Z.EUS:nodejs:14:8040020211213111158:522a0ee4:npm-1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite" } ] }
rhsa-2021_5171
Vulnerability from csaf_redhat
Published
2021-12-16 17:21
Modified
2024-12-17 22:54
Summary
Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update
Notes
Topic
An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)
Security Fix(es):
* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)
* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
* normalize-url: ReDoS for data URLs (CVE-2021-33502)
* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)
* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2021:5171", "url": "https://access.redhat.com/errata/RHSA-2021:5171" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "1945459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1945459" }, { "category": "external", "summary": "1964461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1964461" }, { "category": "external", "summary": "2007557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007557" }, { "category": "external", "summary": "2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5171.json" } ], "title": "Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-12-17T22:54:04+00:00", "generator": { "date": "2024-12-17T22:54:04+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2021:5171", "initial_release_date": "2021-12-16T17:21:31+00:00", "revision_history": [ { "date": "2021-12-16T17:21:31+00:00", "number": "1", "summary": "Initial version" }, { "date": "2021-12-16T17:21:31+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-17T22:54:04+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "nodejs:16:8050020211206113934:c5368500", "product": { "name": "nodejs:16:8050020211206113934:c5368500", "product_id": "nodejs:16:8050020211206113934:c5368500", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/nodejs@16:8050020211206113934:c5368500" } } }, { "category": "product_version", "name": "nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "product": { "name": "nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "product_id": "nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-docs@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "product": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "product_id": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.15-1.module%2Bel8.5.0%2B13548%2B45d748af?arch=noarch" } } }, { "category": "product_version", "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product_id": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@25-1.module%2Bel8.5.0%2B10992%2Bfac5fe06?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product": { "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product_id": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product": { "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product_id": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product": { "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product_id": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product": { "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product_id": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product": { "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product_id": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "product": { "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "product_id": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.1.2-1.16.13.1.3.module%2Bel8.5.0%2B13548%2B45d748af?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "product": { "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "product_id": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "product": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "product_id": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-nodemon@2.0.15-1.module%2Bel8.5.0%2B13548%2B45d748af?arch=src" } } }, { "category": "product_version", "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product_id": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-packaging@25-1.module%2Bel8.5.0%2B10992%2Bfac5fe06?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product": { "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product_id": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product": { "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product_id": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product": { "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product_id": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product": { "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product_id": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product": { "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product_id": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64", "product": { "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64", "product_id": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.1.2-1.16.13.1.3.module%2Bel8.5.0%2B13548%2B45d748af?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product": { "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product_id": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product": { "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product_id": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product": { "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product_id": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product": { "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product_id": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product": { "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product_id": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "product": { "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "product_id": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.1.2-1.16.13.1.3.module%2Bel8.5.0%2B13548%2B45d748af?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product": { "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product_id": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product": { "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product_id": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debuginfo@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product": { "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product_id": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-debugsource@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product": { "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product_id": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-devel@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product": { "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product_id": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-full-i18n@16.13.1-3.module%2Bel8.5.0%2B13548%2B45d748af?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "product": { "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "product_id": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/npm@8.1.2-1.16.13.1.3.module%2Bel8.5.0%2B13548%2B45d748af?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, "product_reference": "nodejs:16:8050020211206113934:c5368500", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64" }, "product_reference": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le" }, "product_reference": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x" }, "product_reference": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src" }, "product_reference": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64" }, "product_reference": "nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64" }, "product_reference": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le" }, "product_reference": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x" }, "product_reference": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64" }, "product_reference": "nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64" }, "product_reference": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le" }, "product_reference": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x" }, "product_reference": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64" }, "product_reference": "nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64" }, "product_reference": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le" }, "product_reference": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x" }, "product_reference": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64" }, "product_reference": "nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch" }, "product_reference": "nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64" }, "product_reference": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le" }, "product_reference": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x" }, "product_reference": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64" }, "product_reference": "nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch" }, "product_reference": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src" }, "product_reference": "nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch" }, "product_reference": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src" }, "product_reference": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64" }, "product_reference": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le" }, "product_reference": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x" }, "product_reference": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" }, { "category": "default_component_of", "full_product_name": { "name": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64 as a component of nodejs:16:8050020211206113934:c5368500 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" }, "product_reference": "npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64", "relates_to_product_reference": "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-7788", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-12-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1907444" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ini: Prototype pollution via malicious INI file", "title": "Vulnerability summary" }, { "category": "other", "text": "Node.JS packages in Red Hat Enterprise Linux and Red Hat Software Collections included the vulnerable dependency packaged in \"nodejs-npm\" component. Processing malicious files using npm could potentially trigger this vulnerability. The \"ini\" package bundled with npm was not in the library path where it could be included directly in other programs.\n\nThe nodejs-nodemon packages in Red Hat Enterprise Linux and Red Hat Software Collections are affected by this vulnerability as they bundle the nodejs-ini library. Usage of that library is governed by nodemon itself, so applications started by nodemon are not impacted. Further, nodemon is a developer tool not intended to be used in production.\n\nThe ini package is included in Red Hat Quay by protractor and webpack-cli, both of which are dev dependencies.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7788" }, { "category": "external", "summary": "RHBZ#1907444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907444" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7788", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7788" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7788" } ], "release_date": "2020-12-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-12-16T17:21:31+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:5171" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ini: Prototype pollution via malicious INI file" }, { "cve": "CVE-2020-28469", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-04-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1945459" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-glob-parent. The enclosure regex used to check for glob enclosures containing backslashes is vulnerable to Regular Expression Denial of Service attacks. This flaw allows an attacker to cause a denial of service if they can supply a malicious string to the glob-parent function. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-glob-parent: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "While some components do package a vulnerable version of glob-parent, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:\n - OpenShift Container Platform (OCP)\n - OpenShift ServiceMesh (OSSM)\n - Red Hat Advanced Cluster Management for Kubernetes (RHACM)\n - OpenShift distributed tracing", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-28469" }, { "category": "external", "summary": "RHBZ#1945459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1945459" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28469", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28469" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28469", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28469" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905", "url": "https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905" } ], "release_date": "2021-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-12-16T17:21:31+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:5171" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-glob-parent: Regular expression denial of service" }, { "cve": "CVE-2021-3807", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-09-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2007557" } ], "notes": [ { "category": "description", "text": "A regular expression denial of service (ReDoS) vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw requires crafted invalid ANSI escape codes in order to be exploited and only allows for denial of service of applications on the client side, hence the impact has been rated as Moderate.\n\nIn Red Hat Virtualization and Red Hat Quay some components use a vulnerable version of ansi-regex. However, all frontend code is executed on the client side. As the maximum impact of this vulnerability is denial of service in the client, the vulnerability is rated Moderate for those products.\n\nOpenShift Container Platform 4 (OCP) ships affected version of ansi-regex in the ose-metering-hadoop container, however the metering operator is deprecated since 4.6[1]. This issue is not currently planned to be addressed in future updates and hence hadoop container has been marked as \u0027will not fix\u0027.\n\nAdvanced Cluster Management for Kubernetes (RHACM) ships the affected version of ansi-regex in several containers, however the impact of this vulnerability is deemed low as it would result in an authenticated slowing down their own user interface. \n\n[1] https://docs.openshift.com/container-platform/4.6/metering/metering-about-metering.html", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src" ], "known_not_affected": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3807" }, { "category": "external", "summary": "RHBZ#2007557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007557" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3807", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3807" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3807", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3807" }, { "category": "external", "summary": "https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994", "url": "https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994" } ], "release_date": "2021-09-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-12-16T17:21:31+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:5171" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes" }, { "cve": "CVE-2021-3918", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "discovery_date": "2021-11-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2024702" } ], "notes": [ { "category": "description", "text": "The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-json-schema: Prototype pollution vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "npm versions 8.0.0 and older provide a vulnerable version of the json-schema library. However, it is currently believed that in the context of npm, it is not possible to take advantage of the vulnerability.\n\nRed Hat Enterprise Linux version 8 and Software Collections provide a vulnerable version of the json-schema library only as embedded in the npm package. As a result, the severity of the incident has been lowered for these 2 products.\n\nRed Hat Quay includes json-schema as a development dependency of quay-registry-container. As a result, the impact rating has been lowered to Moderate.\n\nIn Red Hat OpenShift Container Platform (RHOCP), Red Hat Openshift Data Foundations (ODF), Red Hat distributed tracing, Migration Toolkit for Virtualization (MTV) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth. This restricts access to the vulnerable json-schema library to authenticated users only, therefore the impact is reduced to Moderate.\n\nIn Red Hat Openshift Data Foundations (ODF) the odf4/mcg-core-rhel8 component has \"Will not fix status\", but starting from ODF 4.11 stream this component contains already patched version of the json-schema library. Earlier version of ODF are already under Maintenance Support phase, hence this vulnerability will not be fixed.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3918" }, { "category": "external", "summary": "RHBZ#2024702", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024702" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3918", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3918" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3918" } ], "release_date": "2021-10-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-12-16T17:21:31+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:5171" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-json-schema: Prototype pollution vulnerability" }, { "cve": "CVE-2021-22959", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014057" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling due to spaces in headers", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22959" }, { "category": "external", "summary": "RHBZ#2014057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014057" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22959", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-12-16T17:21:31+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:5171" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling due to spaces in headers" }, { "cve": "CVE-2021-22960", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2021-10-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2014059" } ], "notes": [ { "category": "description", "text": "An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer shipped, starting with Quay 3.5 [2].\n[1] https://catalog.redhat.com/software/containers/quay/quay-rhel8/600e03aadd19c7786c43ae49?container-tabs=security\n[2] https://issues.redhat.com/browse/PROJQUAY-1409\nTherefore Quay component is marked as \"Will not fix\".", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-22960" }, { "category": "external", "summary": "RHBZ#2014059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2014059" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22960", "url": "https://www.cve.org/CVERecord?id=CVE-2021-22960" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22960" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/" } ], "release_date": "2021-10-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-12-16T17:21:31+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:5171" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "llhttp: HTTP Request Smuggling when parsing the body of chunked requests" }, { "cve": "CVE-2021-33502", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2021-05-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1964461" } ], "notes": [ { "category": "description", "text": "A flaw was found in normalize-url. Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-normalize-url: ReDoS for data URLs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-33502" }, { "category": "external", "summary": "RHBZ#1964461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1964461" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-33502", "url": "https://www.cve.org/CVERecord?id=CVE-2021-33502" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-33502", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33502" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539", "url": "https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539" } ], "release_date": "2021-05-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-12-16T17:21:31+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:5171" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debuginfo-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-debugsource-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-devel-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-docs-1:16.13.1-3.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-full-i18n-1:16.13.1-3.module+el8.5.0+13548+45d748af.x86_64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-nodemon-0:2.0.15-1.module+el8.5.0+13548+45d748af.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.aarch64", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.ppc64le", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.s390x", "AppStream-8.5.0.Z.MAIN:nodejs:16:8050020211206113934:c5368500:npm-1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-normalize-url: ReDoS for data URLs" } ] }
wid-sec-w-2022-0100
Vulnerability from csaf_certbund
Published
2022-01-18 23:00
Modified
2024-03-03 23:00
Summary
Oracle Java SE und OpenJDK: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).
OpenJDK ist eine Java Umgebung, die unter der GPLv2 veröffentlicht wird.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE und OpenJDK ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Betroffene Betriebssysteme
- UNIX
- Linux
- MacOS X
- Windows
- NetApp Appliance
- Sonstiges
- Appliance
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).\r\nOpenJDK ist eine Java Umgebung, die unter der GPLv2 ver\u00f6ffentlicht wird.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE und OpenJDK ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- MacOS X\n- Windows\n- NetApp Appliance\n- Sonstiges\n- Appliance", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-0100 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0100.json" }, { "category": "self", "summary": "WID-SEC-2022-0100 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0100" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - January 2022 - Appendix Oracle Java SE vom 2022-01-18", "url": "https://www.oracle.com/security-alerts/cpujan2022.html#AppendixJAVA" }, { "category": "external", "summary": "OpenJDK Vulnerability Advisory: 2022/01/18", "url": "https://openjdk.java.net/groups/vulnerability/advisories/2022-01-18" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0161 vom 2022-01-19", "url": "http://linux.oracle.com/errata/ELSA-2022-0161.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0161 vom 2022-01-19", "url": "https://access.redhat.com/errata/RHSA-2022:0161" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0209 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0209" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0211 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0211" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0204 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0204" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0233 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0233" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0185 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0185" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0166 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0166" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0165 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0165" }, { "category": "external", "summary": "Debian Security Advisory DSA-5057 vom 2022-01-24", "url": "https://lists.debian.org/debian-security-announce/2022/msg00023.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0228 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0228" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0229 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0229" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0185 vom 2022-01-24", "url": "https://linux.oracle.com/errata/ELSA-2022-0185.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0204 vom 2022-01-24", "url": "https://linux.oracle.com/errata/ELSA-2022-0204.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5058 vom 2022-01-25", "url": "https://lists.debian.org/debian-security-announce/2022/msg00026.html" }, { "category": "external", "summary": "CentOS Security Advisory CESA-2022:0204 vom 2022-01-25", "url": "https://lists.centos.org/pipermail/centos-announce/2022-January/073550.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0304 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0304" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0305 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0305" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0306 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0306" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0307 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0307" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0312 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0312" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0317 vom 2022-01-28", "url": "https://access.redhat.com/errata/RHSA-2022:0317" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0321 vom 2022-01-28", "url": "https://access.redhat.com/errata/RHSA-2022:0321" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0306 vom 2022-01-27", "url": "https://linux.oracle.com/errata/ELSA-2022-0306.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0307 vom 2022-01-27", "url": "https://linux.oracle.com/errata/ELSA-2022-0307.html" }, { "category": "external", "summary": "AVAYA Security Advisory ASA-2022-008 vom 2021-01-31", "url": "https://downloads.avaya.com/css/P8/documents/101080371" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0409 vom 2022-02-02", "url": "https://access.redhat.com/errata/RHSA-2022:0409" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0415 vom 2022-02-03", "url": "https://access.redhat.com/errata/RHSA-2022:0415" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0283 vom 2022-02-03", "url": "https://access.redhat.com/errata/RHSA-2022:0283" }, { "category": "external", "summary": "AVAYA Security Advisory ASA-2022-005 vom 2022-02-01", "url": "https://downloads.avaya.com/css/P8/documents/101080372" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2022-104 vom 2022-02-04", "url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-104/index.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0444 vom 2022-02-08", "url": "https://access.redhat.com/errata/RHSA-2022:0444" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0445 vom 2022-02-08", "url": "https://access.redhat.com/errata/RHSA-2022:0445" }, { "category": "external", "summary": "Debian Security Advisory DLA-2917 vom 2022-02-10", "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1752 vom 2022-02-21", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1752.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1753 vom 2022-02-21", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1753.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0730-1 vom 2022-03-04", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010371.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5313-1 vom 2022-03-07", "url": "https://ubuntu.com/security/notices/USN-5313-1" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-037 vom 2022-03-09", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-037.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0816-1 vom 2022-03-14", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010427.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0871-1 vom 2022-03-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010456.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0873-1 vom 2022-03-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010457.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0970 vom 2022-03-21", "url": "https://access.redhat.com/errata/RHSA-2022:0970" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0968 vom 2022-03-21", "url": "https://access.redhat.com/errata/RHSA-2022:0968" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0969 vom 2022-03-21", "url": "https://access.redhat.com/errata/RHSA-2022:0969" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:14927-1 vom 2022-03-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010505.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:14926-1 vom 2022-03-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010503.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:1051 vom 2022-03-24", "url": "https://access.redhat.com/errata/RHSA-2022:1051" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5313-2 vom 2022-03-29", "url": "https://ubuntu.com/security/notices/USN-5313-2" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:1027-1 vom 2022-03-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010559.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:1026-1 vom 2022-03-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010556.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:1025-1 vom 2022-03-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010560.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-047 vom 2022-04-22", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-047.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4918 vom 2022-06-06", "url": "https://access.redhat.com/errata/RHSA-2022:4918" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4919 vom 2022-06-06", "url": "https://access.redhat.com/errata/RHSA-2022:4919" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4922 vom 2022-06-06", "url": "https://access.redhat.com/errata/RHSA-2022:4922" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4957 vom 2022-06-09", "url": "https://access.redhat.com/errata/RHSA-2022:4957" }, { "category": "external", "summary": "AVAYA Security Advisory ASA-2022-018 vom 2022-06-19", "url": "https://download.avaya.com/css/public/documents/101082272" }, { "category": "external", "summary": "Brocade Security Advisory BSA-2022-1732 vom 2022-06-24", "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1732" }, { "category": "external", "summary": "Brocade Security Advisory BSA-2022-1980 vom 2022-06-24", "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1980" }, { "category": "external", "summary": "NetApp Security Advisory NTAP-20220121-0007 vom 2022-07-01", "url": "https://security.netapp.com/advisory/ntap-20220121-0007/" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1821 vom 2022-07-21", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1821.html" }, { "category": "external", "summary": "HCL Article KB0099493 vom 2022-07-21", "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0099493" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:2540-1 vom 2022-07-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-July/011646.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:2539-1 vom 2022-07-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-July/011645.html" }, { "category": "external", "summary": "Broadcom Security Advisory", "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-2019" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:2650-1 vom 2022-08-03", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-August/011760.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1631 vom 2022-08-23", "url": "https://alas.aws.amazon.com/ALAS-2022-1631.html" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202209-05 vom 2022-09-07", "url": "https://security.gentoo.org/glsa/202209-05" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1633 vom 2022-09-12", "url": "https://alas.aws.amazon.com/ALAS-2022-1633.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1835 vom 2022-09-15", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1835.html" }, { "category": "external", "summary": "IBM Security Bulletin 6824779 vom 2022-09-29", "url": "https://www.ibm.com/blogs/psirt/security-bulletin-txseries-for-multiplatforms-is-vulnerable-to-a-denial-of-service-exposure-due-to-ibm-sdk-java-technology-edition-2/" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALASJAVA-OPENJDK11-2023-003 vom 2023-02-23", "url": "https://alas.aws.amazon.com/AL2/ALASJAVA-OPENJDK11-2023-003.html" }, { "category": "external", "summary": "XEROX Security Advisory XRX24-005 vom 2024-03-04", "url": "https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox-Security-Bulletin-XRX24-005-Xerox-FreeFlow%C2%AE-Print-Server-v9_Feb-2024.pdf" } ], "source_lang": "en-US", "title": "Oracle Java SE und OpenJDK: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-03-03T23:00:00.000+00:00", "generator": { "date": "2024-03-04T09:07:32.115+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-0100", "initial_release_date": "2022-01-18T23:00:00.000+00:00", "revision_history": [ { "date": "2022-01-18T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-01-19T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen" }, { "date": "2022-01-23T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-01-24T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat und Debian aufgenommen" }, { "date": "2022-01-25T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Debian und CentOS aufgenommen" }, { "date": "2022-01-27T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Fedora und Red Hat aufgenommen" }, { "date": "2022-01-30T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2022-02-02T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von AVAYA, Red Hat und Fedora aufgenommen" }, { "date": "2022-02-03T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von HITACHI aufgenommen" }, { "date": "2022-02-07T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-02-09T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2022-02-15T23:00:00.000+00:00", "number": "12", "summary": "Referenz(en) aufgenommen: FEDORA-2022-D877B248A5" }, { "date": "2022-02-17T23:00:00.000+00:00", "number": "13", "summary": "Referenz(en) aufgenommen: FEDORA-2022-477401B0F7" }, { "date": "2022-02-21T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-03-02T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von AVAYA aufgenommen" }, { "date": "2022-03-06T23:00:00.000+00:00", "number": "16", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-03-07T23:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2022-03-08T23:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-03-14T23:00:00.000+00:00", "number": "19", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-03-16T23:00:00.000+00:00", "number": "20", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-03-20T23:00:00.000+00:00", "number": "21", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-03-23T23:00:00.000+00:00", "number": "22", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-03-24T23:00:00.000+00:00", "number": "23", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-03-29T22:00:00.000+00:00", "number": "24", "summary": "Neue Updates von Ubuntu und SUSE aufgenommen" }, { "date": "2022-04-24T22:00:00.000+00:00", "number": "25", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-06-06T22:00:00.000+00:00", "number": "26", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-06-08T22:00:00.000+00:00", "number": "27", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-06-19T22:00:00.000+00:00", "number": "28", "summary": "Neue Updates von AVAYA aufgenommen" }, { "date": "2022-06-26T22:00:00.000+00:00", "number": "29", "summary": "Neue Updates von BROCADE aufgenommen" }, { "date": "2022-07-03T22:00:00.000+00:00", "number": "30", "summary": "Neue Updates von NetApp aufgenommen" }, { "date": "2022-07-20T22:00:00.000+00:00", "number": "31", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-07-21T22:00:00.000+00:00", "number": "32", "summary": "Neue Updates von HCL aufgenommen" }, { "date": "2022-07-24T22:00:00.000+00:00", "number": "33", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-08-01T22:00:00.000+00:00", "number": "34", "summary": "Neue Updates von BROCADE aufgenommen" }, { "date": "2022-08-03T22:00:00.000+00:00", "number": "35", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-08-23T22:00:00.000+00:00", "number": "36", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-09-06T22:00:00.000+00:00", "number": "37", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2022-09-12T22:00:00.000+00:00", "number": "38", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-09-14T22:00:00.000+00:00", "number": "39", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-09-28T22:00:00.000+00:00", "number": "40", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-02-23T23:00:00.000+00:00", "number": "41", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2024-03-03T23:00:00.000+00:00", "number": "42", "summary": "Neue Updates von XEROX aufgenommen" } ], "status": "final", "version": "42" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Avaya Aura Application Enablement Services", "product": { "name": "Avaya Aura Application Enablement Services", "product_id": "T015516", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_application_enablement_services:-" } } }, { "category": "product_name", "name": "Avaya Aura Communication Manager", "product": { "name": "Avaya Aura Communication Manager", "product_id": "T015126", "product_identification_helper": { "cpe": "cpe:/a:avaya:communication_manager:-" } } }, { "category": "product_name", "name": "Avaya Aura Device Services", "product": { "name": "Avaya Aura Device Services", "product_id": "T015517", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_device_services:-" } } }, { "category": "product_name", "name": "Avaya Aura Experience Portal", "product": { "name": "Avaya Aura Experience Portal", "product_id": "T015519", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_experience_portal:-" } } }, { "category": "product_name", "name": "Avaya Aura Session Manager", "product": { "name": "Avaya Aura Session Manager", "product_id": "T015127", "product_identification_helper": { "cpe": "cpe:/a:avaya:session_manager:-" } } }, { "category": "product_name", "name": "Avaya Aura System Manager", "product": { "name": "Avaya Aura System Manager", "product_id": "T015518", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_system_manager:-" } } }, { "category": "product_name", "name": "Avaya Breeze Platform", "product": { "name": "Avaya Breeze Platform", "product_id": "T015823", "product_identification_helper": { "cpe": "cpe:/a:avaya:breeze_platform:-" } } }, { "category": "product_name", "name": "Avaya CMS", "product": { "name": "Avaya CMS", "product_id": "997", "product_identification_helper": { "cpe": "cpe:/a:avaya:call_management_system_server:-" } } }, { "category": "product_name", "name": "Avaya Session Border Controller", "product": { "name": "Avaya Session Border Controller", "product_id": "T015520", "product_identification_helper": { "cpe": "cpe:/h:avaya:session_border_controller:-" } } }, { "category": "product_name", "name": "Avaya Web License Manager", "product": { "name": "Avaya Web License Manager", "product_id": "T016243", "product_identification_helper": { "cpe": "cpe:/a:avaya:web_license_manager:-" } } } ], "category": "vendor", "name": "Avaya" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c v2.2.0.2", "product": { "name": "Broadcom Brocade SANnav \u003c v2.2.0.2", "product_id": "T023628", "product_identification_helper": { "cpe": "cpe:/a:broadcom:brocade_sannav:v2.2.0.2" } } } ], "category": "product_name", "name": "Brocade SANnav" } ], "category": "vendor", "name": "Broadcom" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "HCL BigFix", "product": { "name": "HCL BigFix", "product_id": "T017494", "product_identification_helper": { "cpe": "cpe:/a:hcltech:bigfix:-" } } } ], "category": "vendor", "name": "HCL" }, { "branches": [ { "category": "product_name", "name": "Hitachi Command Suite", "product": { "name": "Hitachi Command Suite", "product_id": "T010951", "product_identification_helper": { "cpe": "cpe:/a:hitachi:command_suite:-" } } }, { "category": "product_name", "name": "Hitachi Configuration Manager", "product": { "name": "Hitachi Configuration Manager", "product_id": "T020304", "product_identification_helper": { "cpe": "cpe:/a:hitachi:configuration_manager:-" } } }, { "category": "product_name", "name": "Hitachi Ops Center", "product": { "name": "Hitachi Ops Center", "product_id": "T017562", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:-" } } } ], "category": "vendor", "name": "Hitachi" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "9.1", "product": { "name": "IBM TXSeries 9.1", "product_id": "T015903", "product_identification_helper": { "cpe": "cpe:/a:ibm:txseries:for_multiplatforms_9.1" } } }, { "category": "product_version", "name": "8.2", "product": { "name": "IBM TXSeries 8.2", "product_id": "T015904", "product_identification_helper": { "cpe": "cpe:/a:ibm:txseries:for_multiplatforms_8.2" } } }, { "category": "product_version", "name": "8.1", "product": { "name": "IBM TXSeries 8.1", "product_id": "T015905", "product_identification_helper": { "cpe": "cpe:/a:ibm:txseries:for_multiplatforms_8.1" } } } ], "category": "product_name", "name": "TXSeries" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "NetApp ActiveIQ Unified Manager", "product": { "name": "NetApp ActiveIQ Unified Manager", "product_id": "T016960", "product_identification_helper": { "cpe": "cpe:/a:netapp:active_iq_unified_manager:-" } } } ], "category": "vendor", "name": "NetApp" }, { "branches": [ { "category": "product_name", "name": "Open Source CentOS", "product": { "name": "Open Source CentOS", "product_id": "1727", "product_identification_helper": { "cpe": "cpe:/o:centos:centos:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003c= 11.0.13", "product": { "name": "Open Source OpenJDK \u003c= 11.0.13", "product_id": "989628", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:11.0.13" } } }, { "category": "product_version_range", "name": "\u003c= 17.0.1", "product": { "name": "Open Source OpenJDK \u003c= 17.0.1", "product_id": "T021759", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:17.0.1" } } }, { "category": "product_version_range", "name": "\u003c= 15.0.5", "product": { "name": "Open Source OpenJDK \u003c= 15.0.5", "product_id": "T021760", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:15.0.5" } } }, { "category": "product_version_range", "name": "\u003c= 13.0.9", "product": { "name": "Open Source OpenJDK \u003c= 13.0.9", "product_id": "T021761", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:13.0.9" } } }, { "category": "product_version_range", "name": "\u003c= 8u312", "product": { "name": "Open Source OpenJDK \u003c= 8u312", "product_id": "T021762", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:8:u312" } } }, { "category": "product_version_range", "name": "\u003c= 7u321", "product": { "name": "Open Source OpenJDK \u003c= 7u321", "product_id": "T021763", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:7:u321" } } } ], "category": "product_name", "name": "OpenJDK" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "Enterprise Edition 20.3.4", "product": { "name": "Oracle GraalVM Enterprise Edition 20.3.4", "product_id": "T021750", "product_identification_helper": { "cpe": "cpe:/a:oracle:graalvm:20.3.4::enterprise" } } }, { "category": "product_version", "name": "Enterprise Edition 21.3.0", "product": { "name": "Oracle GraalVM Enterprise Edition 21.3.0", "product_id": "T021755", "product_identification_helper": { "cpe": "cpe:/a:oracle:graalvm:21.3.0::enterprise" } } } ], "category": "product_name", "name": "GraalVM" }, { "branches": [ { "category": "product_version", "name": "11.0.13", "product": { "name": "Oracle Java SE 11.0.13", "product_id": "T021700", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:11.0.13" } } }, { "category": "product_version", "name": "7u321", "product": { "name": "Oracle Java SE 7u321", "product_id": "T021752", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:7:u321" } } }, { "category": "product_version", "name": "8u311", "product": { "name": "Oracle Java SE 8u311", "product_id": "T021753", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:8:u311" } } }, { "category": "product_version", "name": "17.01", "product": { "name": "Oracle Java SE 17.01", "product_id": "T021754", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:17.01" } } } ], "category": "product_name", "name": "Java SE" }, { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "v9", "product": { "name": "Xerox FreeFlow Print Server v9", "product_id": "T015632", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:v9" } } } ], "category": "product_name", "name": "FreeFlow Print Server" } ], "category": "vendor", "name": "Xerox" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-22959", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2021-22959" }, { "cve": "CVE-2022-21248", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21248" }, { "cve": "CVE-2022-21271", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21271" }, { "cve": "CVE-2022-21277", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21277" }, { "cve": "CVE-2022-21282", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21282" }, { "cve": "CVE-2022-21283", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21283" }, { "cve": "CVE-2022-21291", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21291" }, { "cve": "CVE-2022-21293", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21293" }, { "cve": "CVE-2022-21294", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21294" }, { "cve": "CVE-2022-21296", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21296" }, { "cve": "CVE-2022-21299", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21299" }, { "cve": "CVE-2022-21305", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21305" }, { "cve": "CVE-2022-21340", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21340" }, { "cve": "CVE-2022-21341", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21341" }, { "cve": "CVE-2022-21349", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21349" }, { "cve": "CVE-2022-21360", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21360" }, { "cve": "CVE-2022-21365", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21365" }, { "cve": "CVE-2022-21366", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21366" } ] }
wid-sec-w-2022-0093
Vulnerability from csaf_certbund
Published
2021-10-12 22:00
Modified
2024-05-09 22:00
Summary
Node.js: Mehrere Schwachstellen ermöglichen "HTTP request smuggling"
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen "HTTP request smuggling" Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
- MacOS X
- Sonstiges
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen \"HTTP request smuggling\" Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-0093 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2022-0093.json" }, { "category": "self", "summary": "WID-SEC-2022-0093 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0093" }, { "category": "external", "summary": "Arch Linux Security Advisory ASA-202110-5 vom 2021-10-21", "url": "https://security.archlinux.org/ASA-202110-5" }, { "category": "external", "summary": "Arch Linux Security Advisory ASA-202110-4 vom 2021-10-21", "url": "https://security.archlinux.org/ASA-202110-4" }, { "category": "external", "summary": "Arch Linux Security Advisory ASA-202110-6 vom 2021-10-21", "url": "https://security.archlinux.org/ASA-202110-6" }, { "category": "external", "summary": "Node.js October 2021 Security Releases vom 2021-10-12", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:3886-1 vom 2021-12-02", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-December/009816.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:3940-1 vom 2021-12-06", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-December/009853.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:3964-1 vom 2021-12-07", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-December/009869.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2021-5171 vom 2021-12-16", "url": "http://linux.oracle.com/errata/ELSA-2021-5171.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:5171 vom 2021-12-16", "url": "https://access.redhat.com/errata/RHSA-2021:5171" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0041 vom 2022-01-06", "url": "https://access.redhat.com/errata/RHSA-2022:0041" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0101-1 vom 2022-01-18", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-January/010017.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0246 vom 2022-01-25", "url": "https://access.redhat.com/errata/RHSA-2022:0246" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-013 vom 2022-01-27", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-013.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4914 vom 2022-06-06", "url": "https://access.redhat.com/errata/RHSA-2022:4914" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0350 vom 2022-02-02", "url": "https://access.redhat.com/errata/RHSA-2022:0350" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0350 vom 2022-02-02", "url": "http://linux.oracle.com/errata/ELSA-2022-0350.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5170 vom 2022-06-27", "url": "https://lists.debian.org/debian-security-announce/2022/msg00138.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:2855-1 vom 2022-08-19", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-August/011954.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-214 vom 2022-12-09", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-214.html" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202405-29 vom 2024-05-08", "url": "https://security.gentoo.org/glsa/202405-29" } ], "source_lang": "en-US", "title": "Node.js: Mehrere Schwachstellen erm\u00f6glichen \"HTTP request smuggling\"", "tracking": { "current_release_date": "2024-05-09T22:00:00.000+00:00", "generator": { "date": "2024-05-10T09:04:19.208+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-0093", "initial_release_date": "2021-10-12T22:00:00.000+00:00", "revision_history": [ { "date": "2021-10-12T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2021-10-17T22:00:00.000+00:00", "number": "2", "summary": "Referenz(en) aufgenommen: FEDORA-2021-9818CABE0D" }, { "date": "2021-10-21T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Arch Linux aufgenommen" }, { "date": "2021-12-02T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-12-06T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-12-07T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-12-16T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen" }, { "date": "2022-01-06T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-01-18T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-01-24T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-01-27T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-02-01T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-02-02T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2022-06-06T22:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-06-27T22:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2022-08-21T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-12-11T23:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2024-05-09T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Gentoo aufgenommen" } ], "status": "final", "version": "18" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "Open Source Arch Linux", "product": { "name": "Open Source Arch Linux", "product_id": "T013312", "product_identification_helper": { "cpe": "cpe:/o:archlinux:archlinux:-" } } }, { "branches": [ { "category": "product_version", "name": "12.x", "product": { "name": "Open Source Node.js 12.x", "product_id": "T019652", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:12.x" } } }, { "category": "product_version", "name": "14.x", "product": { "name": "Open Source Node.js 14.x", "product_id": "T019653", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:14.x" } } }, { "category": "product_version", "name": "16.x", "product": { "name": "Open Source Node.js 16.x", "product_id": "T019654", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:16.x" } } } ], "category": "product_name", "name": "Node.js" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-22959", "notes": [ { "category": "description", "text": "In Node.js existieren mehrere Schwachstellen im http Parser. Chunked requests und Header-Namen mit Leerzeichen werden nicht ordnungsgem\u00e4\u00df verarbeitet. Ein Angreifer kann dieses zu einem \"HTTP request smuggling\" nutzen und in der Folge u. a. Sicherheitsmechanismen umgehen, Daten manipulieren oder Authentisierungsmerkmale stehlen." } ], "product_status": { "known_affected": [ "T019654", "T019653", "2951", "T002207", "67646", "T013312", "398363", "T012167", "T004914", "T019652" ] }, "release_date": "2021-10-12T22:00:00Z", "title": "CVE-2021-22959" }, { "cve": "CVE-2021-22960", "notes": [ { "category": "description", "text": "In Node.js existieren mehrere Schwachstellen im http Parser. Chunked requests und Header-Namen mit Leerzeichen werden nicht ordnungsgem\u00e4\u00df verarbeitet. Ein Angreifer kann dieses zu einem \"HTTP request smuggling\" nutzen und in der Folge u. a. Sicherheitsmechanismen umgehen, Daten manipulieren oder Authentisierungsmerkmale stehlen." } ], "product_status": { "known_affected": [ "T019654", "T019653", "2951", "T002207", "67646", "T013312", "398363", "T012167", "T004914", "T019652" ] }, "release_date": "2021-10-12T22:00:00Z", "title": "CVE-2021-22960" } ] }
WID-SEC-W-2022-0100
Vulnerability from csaf_certbund
Published
2022-01-18 23:00
Modified
2024-03-03 23:00
Summary
Oracle Java SE und OpenJDK: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).
OpenJDK ist eine Java Umgebung, die unter der GPLv2 veröffentlicht wird.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE und OpenJDK ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Betroffene Betriebssysteme
- UNIX
- Linux
- MacOS X
- Windows
- NetApp Appliance
- Sonstiges
- Appliance
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Die Java Platform, Standard Edition (SE) ist eine Sammlung von Java-APIs (JDK) und der Java Laufzeit Umgebung (JRE).\r\nOpenJDK ist eine Java Umgebung, die unter der GPLv2 ver\u00f6ffentlicht wird.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE und OpenJDK ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- MacOS X\n- Windows\n- NetApp Appliance\n- Sonstiges\n- Appliance", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-0100 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0100.json" }, { "category": "self", "summary": "WID-SEC-2022-0100 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0100" }, { "category": "external", "summary": "Oracle Critical Patch Update Advisory - January 2022 - Appendix Oracle Java SE vom 2022-01-18", "url": "https://www.oracle.com/security-alerts/cpujan2022.html#AppendixJAVA" }, { "category": "external", "summary": "OpenJDK Vulnerability Advisory: 2022/01/18", "url": "https://openjdk.java.net/groups/vulnerability/advisories/2022-01-18" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0161 vom 2022-01-19", "url": "http://linux.oracle.com/errata/ELSA-2022-0161.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0161 vom 2022-01-19", "url": "https://access.redhat.com/errata/RHSA-2022:0161" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0209 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0209" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0211 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0211" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0204 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0204" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0233 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0233" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0185 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0185" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0166 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0166" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0165 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0165" }, { "category": "external", "summary": "Debian Security Advisory DSA-5057 vom 2022-01-24", "url": "https://lists.debian.org/debian-security-announce/2022/msg00023.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0228 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0228" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0229 vom 2022-01-24", "url": "https://access.redhat.com/errata/RHSA-2022:0229" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0185 vom 2022-01-24", "url": "https://linux.oracle.com/errata/ELSA-2022-0185.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0204 vom 2022-01-24", "url": "https://linux.oracle.com/errata/ELSA-2022-0204.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5058 vom 2022-01-25", "url": "https://lists.debian.org/debian-security-announce/2022/msg00026.html" }, { "category": "external", "summary": "CentOS Security Advisory CESA-2022:0204 vom 2022-01-25", "url": "https://lists.centos.org/pipermail/centos-announce/2022-January/073550.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0304 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0304" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0305 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0305" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0306 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0306" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0307 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0307" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0312 vom 2022-01-27", "url": "https://access.redhat.com/errata/RHSA-2022:0312" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0317 vom 2022-01-28", "url": "https://access.redhat.com/errata/RHSA-2022:0317" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0321 vom 2022-01-28", "url": "https://access.redhat.com/errata/RHSA-2022:0321" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0306 vom 2022-01-27", "url": "https://linux.oracle.com/errata/ELSA-2022-0306.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0307 vom 2022-01-27", "url": "https://linux.oracle.com/errata/ELSA-2022-0307.html" }, { "category": "external", "summary": "AVAYA Security Advisory ASA-2022-008 vom 2021-01-31", "url": "https://downloads.avaya.com/css/P8/documents/101080371" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0409 vom 2022-02-02", "url": "https://access.redhat.com/errata/RHSA-2022:0409" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0415 vom 2022-02-03", "url": "https://access.redhat.com/errata/RHSA-2022:0415" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0283 vom 2022-02-03", "url": "https://access.redhat.com/errata/RHSA-2022:0283" }, { "category": "external", "summary": "AVAYA Security Advisory ASA-2022-005 vom 2022-02-01", "url": "https://downloads.avaya.com/css/P8/documents/101080372" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2022-104 vom 2022-02-04", "url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-104/index.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0444 vom 2022-02-08", "url": "https://access.redhat.com/errata/RHSA-2022:0444" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0445 vom 2022-02-08", "url": "https://access.redhat.com/errata/RHSA-2022:0445" }, { "category": "external", "summary": "Debian Security Advisory DLA-2917 vom 2022-02-10", "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1752 vom 2022-02-21", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1752.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1753 vom 2022-02-21", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1753.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0730-1 vom 2022-03-04", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010371.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5313-1 vom 2022-03-07", "url": "https://ubuntu.com/security/notices/USN-5313-1" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-037 vom 2022-03-09", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-037.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0816-1 vom 2022-03-14", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010427.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0871-1 vom 2022-03-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010456.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0873-1 vom 2022-03-16", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010457.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0970 vom 2022-03-21", "url": "https://access.redhat.com/errata/RHSA-2022:0970" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0968 vom 2022-03-21", "url": "https://access.redhat.com/errata/RHSA-2022:0968" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0969 vom 2022-03-21", "url": "https://access.redhat.com/errata/RHSA-2022:0969" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:14927-1 vom 2022-03-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010505.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:14926-1 vom 2022-03-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010503.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:1051 vom 2022-03-24", "url": "https://access.redhat.com/errata/RHSA-2022:1051" }, { "category": "external", "summary": "Ubuntu Security Notice USN-5313-2 vom 2022-03-29", "url": "https://ubuntu.com/security/notices/USN-5313-2" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:1027-1 vom 2022-03-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010559.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:1026-1 vom 2022-03-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010556.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:1025-1 vom 2022-03-29", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010560.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-047 vom 2022-04-22", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-047.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4918 vom 2022-06-06", "url": "https://access.redhat.com/errata/RHSA-2022:4918" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4919 vom 2022-06-06", "url": "https://access.redhat.com/errata/RHSA-2022:4919" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4922 vom 2022-06-06", "url": "https://access.redhat.com/errata/RHSA-2022:4922" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4957 vom 2022-06-09", "url": "https://access.redhat.com/errata/RHSA-2022:4957" }, { "category": "external", "summary": "AVAYA Security Advisory ASA-2022-018 vom 2022-06-19", "url": "https://download.avaya.com/css/public/documents/101082272" }, { "category": "external", "summary": "Brocade Security Advisory BSA-2022-1732 vom 2022-06-24", "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1732" }, { "category": "external", "summary": "Brocade Security Advisory BSA-2022-1980 vom 2022-06-24", "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1980" }, { "category": "external", "summary": "NetApp Security Advisory NTAP-20220121-0007 vom 2022-07-01", "url": "https://security.netapp.com/advisory/ntap-20220121-0007/" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1821 vom 2022-07-21", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1821.html" }, { "category": "external", "summary": "HCL Article KB0099493 vom 2022-07-21", "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0099493" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:2540-1 vom 2022-07-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-July/011646.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:2539-1 vom 2022-07-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-July/011645.html" }, { "category": "external", "summary": "Broadcom Security Advisory", "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-2019" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:2650-1 vom 2022-08-03", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-August/011760.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1631 vom 2022-08-23", "url": "https://alas.aws.amazon.com/ALAS-2022-1631.html" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202209-05 vom 2022-09-07", "url": "https://security.gentoo.org/glsa/202209-05" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1633 vom 2022-09-12", "url": "https://alas.aws.amazon.com/ALAS-2022-1633.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-1835 vom 2022-09-15", "url": "https://alas.aws.amazon.com/AL2/ALAS-2022-1835.html" }, { "category": "external", "summary": "IBM Security Bulletin 6824779 vom 2022-09-29", "url": "https://www.ibm.com/blogs/psirt/security-bulletin-txseries-for-multiplatforms-is-vulnerable-to-a-denial-of-service-exposure-due-to-ibm-sdk-java-technology-edition-2/" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALASJAVA-OPENJDK11-2023-003 vom 2023-02-23", "url": "https://alas.aws.amazon.com/AL2/ALASJAVA-OPENJDK11-2023-003.html" }, { "category": "external", "summary": "XEROX Security Advisory XRX24-005 vom 2024-03-04", "url": "https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox-Security-Bulletin-XRX24-005-Xerox-FreeFlow%C2%AE-Print-Server-v9_Feb-2024.pdf" } ], "source_lang": "en-US", "title": "Oracle Java SE und OpenJDK: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-03-03T23:00:00.000+00:00", "generator": { "date": "2024-03-04T09:07:32.115+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-0100", "initial_release_date": "2022-01-18T23:00:00.000+00:00", "revision_history": [ { "date": "2022-01-18T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2022-01-19T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen" }, { "date": "2022-01-23T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-01-24T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat und Debian aufgenommen" }, { "date": "2022-01-25T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Debian und CentOS aufgenommen" }, { "date": "2022-01-27T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Fedora und Red Hat aufgenommen" }, { "date": "2022-01-30T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2022-02-02T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von AVAYA, Red Hat und Fedora aufgenommen" }, { "date": "2022-02-03T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von HITACHI aufgenommen" }, { "date": "2022-02-07T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-02-09T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2022-02-15T23:00:00.000+00:00", "number": "12", "summary": "Referenz(en) aufgenommen: FEDORA-2022-D877B248A5" }, { "date": "2022-02-17T23:00:00.000+00:00", "number": "13", "summary": "Referenz(en) aufgenommen: FEDORA-2022-477401B0F7" }, { "date": "2022-02-21T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-03-02T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von AVAYA aufgenommen" }, { "date": "2022-03-06T23:00:00.000+00:00", "number": "16", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-03-07T23:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2022-03-08T23:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-03-14T23:00:00.000+00:00", "number": "19", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-03-16T23:00:00.000+00:00", "number": "20", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-03-20T23:00:00.000+00:00", "number": "21", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-03-23T23:00:00.000+00:00", "number": "22", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-03-24T23:00:00.000+00:00", "number": "23", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-03-29T22:00:00.000+00:00", "number": "24", "summary": "Neue Updates von Ubuntu und SUSE aufgenommen" }, { "date": "2022-04-24T22:00:00.000+00:00", "number": "25", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-06-06T22:00:00.000+00:00", "number": "26", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-06-08T22:00:00.000+00:00", "number": "27", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-06-19T22:00:00.000+00:00", "number": "28", "summary": "Neue Updates von AVAYA aufgenommen" }, { "date": "2022-06-26T22:00:00.000+00:00", "number": "29", "summary": "Neue Updates von BROCADE aufgenommen" }, { "date": "2022-07-03T22:00:00.000+00:00", "number": "30", "summary": "Neue Updates von NetApp aufgenommen" }, { "date": "2022-07-20T22:00:00.000+00:00", "number": "31", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-07-21T22:00:00.000+00:00", "number": "32", "summary": "Neue Updates von HCL aufgenommen" }, { "date": "2022-07-24T22:00:00.000+00:00", "number": "33", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-08-01T22:00:00.000+00:00", "number": "34", "summary": "Neue Updates von BROCADE aufgenommen" }, { "date": "2022-08-03T22:00:00.000+00:00", "number": "35", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-08-23T22:00:00.000+00:00", "number": "36", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-09-06T22:00:00.000+00:00", "number": "37", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2022-09-12T22:00:00.000+00:00", "number": "38", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-09-14T22:00:00.000+00:00", "number": "39", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-09-28T22:00:00.000+00:00", "number": "40", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-02-23T23:00:00.000+00:00", "number": "41", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2024-03-03T23:00:00.000+00:00", "number": "42", "summary": "Neue Updates von XEROX aufgenommen" } ], "status": "final", "version": "42" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Avaya Aura Application Enablement Services", "product": { "name": "Avaya Aura Application Enablement Services", "product_id": "T015516", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_application_enablement_services:-" } } }, { "category": "product_name", "name": "Avaya Aura Communication Manager", "product": { "name": "Avaya Aura Communication Manager", "product_id": "T015126", "product_identification_helper": { "cpe": "cpe:/a:avaya:communication_manager:-" } } }, { "category": "product_name", "name": "Avaya Aura Device Services", "product": { "name": "Avaya Aura Device Services", "product_id": "T015517", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_device_services:-" } } }, { "category": "product_name", "name": "Avaya Aura Experience Portal", "product": { "name": "Avaya Aura Experience Portal", "product_id": "T015519", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_experience_portal:-" } } }, { "category": "product_name", "name": "Avaya Aura Session Manager", "product": { "name": "Avaya Aura Session Manager", "product_id": "T015127", "product_identification_helper": { "cpe": "cpe:/a:avaya:session_manager:-" } } }, { "category": "product_name", "name": "Avaya Aura System Manager", "product": { "name": "Avaya Aura System Manager", "product_id": "T015518", "product_identification_helper": { "cpe": "cpe:/a:avaya:aura_system_manager:-" } } }, { "category": "product_name", "name": "Avaya Breeze Platform", "product": { "name": "Avaya Breeze Platform", "product_id": "T015823", "product_identification_helper": { "cpe": "cpe:/a:avaya:breeze_platform:-" } } }, { "category": "product_name", "name": "Avaya CMS", "product": { "name": "Avaya CMS", "product_id": "997", "product_identification_helper": { "cpe": "cpe:/a:avaya:call_management_system_server:-" } } }, { "category": "product_name", "name": "Avaya Session Border Controller", "product": { "name": "Avaya Session Border Controller", "product_id": "T015520", "product_identification_helper": { "cpe": "cpe:/h:avaya:session_border_controller:-" } } }, { "category": "product_name", "name": "Avaya Web License Manager", "product": { "name": "Avaya Web License Manager", "product_id": "T016243", "product_identification_helper": { "cpe": "cpe:/a:avaya:web_license_manager:-" } } } ], "category": "vendor", "name": "Avaya" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c v2.2.0.2", "product": { "name": "Broadcom Brocade SANnav \u003c v2.2.0.2", "product_id": "T023628", "product_identification_helper": { "cpe": "cpe:/a:broadcom:brocade_sannav:v2.2.0.2" } } } ], "category": "product_name", "name": "Brocade SANnav" } ], "category": "vendor", "name": "Broadcom" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "HCL BigFix", "product": { "name": "HCL BigFix", "product_id": "T017494", "product_identification_helper": { "cpe": "cpe:/a:hcltech:bigfix:-" } } } ], "category": "vendor", "name": "HCL" }, { "branches": [ { "category": "product_name", "name": "Hitachi Command Suite", "product": { "name": "Hitachi Command Suite", "product_id": "T010951", "product_identification_helper": { "cpe": "cpe:/a:hitachi:command_suite:-" } } }, { "category": "product_name", "name": "Hitachi Configuration Manager", "product": { "name": "Hitachi Configuration Manager", "product_id": "T020304", "product_identification_helper": { "cpe": "cpe:/a:hitachi:configuration_manager:-" } } }, { "category": "product_name", "name": "Hitachi Ops Center", "product": { "name": "Hitachi Ops Center", "product_id": "T017562", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:-" } } } ], "category": "vendor", "name": "Hitachi" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "9.1", "product": { "name": "IBM TXSeries 9.1", "product_id": "T015903", "product_identification_helper": { "cpe": "cpe:/a:ibm:txseries:for_multiplatforms_9.1" } } }, { "category": "product_version", "name": "8.2", "product": { "name": "IBM TXSeries 8.2", "product_id": "T015904", "product_identification_helper": { "cpe": "cpe:/a:ibm:txseries:for_multiplatforms_8.2" } } }, { "category": "product_version", "name": "8.1", "product": { "name": "IBM TXSeries 8.1", "product_id": "T015905", "product_identification_helper": { "cpe": "cpe:/a:ibm:txseries:for_multiplatforms_8.1" } } } ], "category": "product_name", "name": "TXSeries" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "NetApp ActiveIQ Unified Manager", "product": { "name": "NetApp ActiveIQ Unified Manager", "product_id": "T016960", "product_identification_helper": { "cpe": "cpe:/a:netapp:active_iq_unified_manager:-" } } } ], "category": "vendor", "name": "NetApp" }, { "branches": [ { "category": "product_name", "name": "Open Source CentOS", "product": { "name": "Open Source CentOS", "product_id": "1727", "product_identification_helper": { "cpe": "cpe:/o:centos:centos:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003c= 11.0.13", "product": { "name": "Open Source OpenJDK \u003c= 11.0.13", "product_id": "989628", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:11.0.13" } } }, { "category": "product_version_range", "name": "\u003c= 17.0.1", "product": { "name": "Open Source OpenJDK \u003c= 17.0.1", "product_id": "T021759", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:17.0.1" } } }, { "category": "product_version_range", "name": "\u003c= 15.0.5", "product": { "name": "Open Source OpenJDK \u003c= 15.0.5", "product_id": "T021760", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:15.0.5" } } }, { "category": "product_version_range", "name": "\u003c= 13.0.9", "product": { "name": "Open Source OpenJDK \u003c= 13.0.9", "product_id": "T021761", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:13.0.9" } } }, { "category": "product_version_range", "name": "\u003c= 8u312", "product": { "name": "Open Source OpenJDK \u003c= 8u312", "product_id": "T021762", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:8:u312" } } }, { "category": "product_version_range", "name": "\u003c= 7u321", "product": { "name": "Open Source OpenJDK \u003c= 7u321", "product_id": "T021763", "product_identification_helper": { "cpe": "cpe:/a:oracle:openjdk:7:u321" } } } ], "category": "product_name", "name": "OpenJDK" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "Enterprise Edition 20.3.4", "product": { "name": "Oracle GraalVM Enterprise Edition 20.3.4", "product_id": "T021750", "product_identification_helper": { "cpe": "cpe:/a:oracle:graalvm:20.3.4::enterprise" } } }, { "category": "product_version", "name": "Enterprise Edition 21.3.0", "product": { "name": "Oracle GraalVM Enterprise Edition 21.3.0", "product_id": "T021755", "product_identification_helper": { "cpe": "cpe:/a:oracle:graalvm:21.3.0::enterprise" } } } ], "category": "product_name", "name": "GraalVM" }, { "branches": [ { "category": "product_version", "name": "11.0.13", "product": { "name": "Oracle Java SE 11.0.13", "product_id": "T021700", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:11.0.13" } } }, { "category": "product_version", "name": "7u321", "product": { "name": "Oracle Java SE 7u321", "product_id": "T021752", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:7:u321" } } }, { "category": "product_version", "name": "8u311", "product": { "name": "Oracle Java SE 8u311", "product_id": "T021753", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:8:u311" } } }, { "category": "product_version", "name": "17.01", "product": { "name": "Oracle Java SE 17.01", "product_id": "T021754", "product_identification_helper": { "cpe": "cpe:/a:oracle:java_se:17.01" } } } ], "category": "product_name", "name": "Java SE" }, { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "v9", "product": { "name": "Xerox FreeFlow Print Server v9", "product_id": "T015632", "product_identification_helper": { "cpe": "cpe:/a:xerox:freeflow_print_server:v9" } } } ], "category": "product_name", "name": "FreeFlow Print Server" } ], "category": "vendor", "name": "Xerox" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-22959", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2021-22959" }, { "cve": "CVE-2022-21248", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21248" }, { "cve": "CVE-2022-21271", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21271" }, { "cve": "CVE-2022-21277", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21277" }, { "cve": "CVE-2022-21282", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21282" }, { "cve": "CVE-2022-21283", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21283" }, { "cve": "CVE-2022-21291", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21291" }, { "cve": "CVE-2022-21293", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21293" }, { "cve": "CVE-2022-21294", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21294" }, { "cve": "CVE-2022-21296", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21296" }, { "cve": "CVE-2022-21299", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21299" }, { "cve": "CVE-2022-21305", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21305" }, { "cve": "CVE-2022-21340", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21340" }, { "cve": "CVE-2022-21341", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21341" }, { "cve": "CVE-2022-21349", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21349" }, { "cve": "CVE-2022-21360", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21360" }, { "cve": "CVE-2022-21365", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21365" }, { "cve": "CVE-2022-21366", "notes": [ { "category": "description", "text": "In Oracle Java SE und OpenJDK existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"LOW\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"MITTEL\" f\u00fcr die Schadensh\u00f6he." } ], "product_status": { "known_affected": [ "T015905", "T015904", "T015903", "67646", "T015823", "T010951", "T015127", "T015126", "T004914", "T015520", "T017494", "T021754", "T021753", "T021752", "T020304", "997", "T021755", "398363", "T021750", "T015519", "T015518", "T015517", "T015516", "T015632", "T012167", "T016960", "T016243", "T017562", "2951", "T002207", "T000126", "T021700", "1727" ], "last_affected": [ "T021763", "T021762", "989628", "T021759", "T021761", "T021760" ] }, "release_date": "2022-01-18T23:00:00Z", "title": "CVE-2022-21366" } ] }
WID-SEC-W-2022-0093
Vulnerability from csaf_certbund
Published
2021-10-12 22:00
Modified
2024-05-09 22:00
Summary
Node.js: Mehrere Schwachstellen ermöglichen "HTTP request smuggling"
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen "HTTP request smuggling" Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
- MacOS X
- Sonstiges
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen \"HTTP request smuggling\" Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-0093 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2022-0093.json" }, { "category": "self", "summary": "WID-SEC-2022-0093 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0093" }, { "category": "external", "summary": "Arch Linux Security Advisory ASA-202110-5 vom 2021-10-21", "url": "https://security.archlinux.org/ASA-202110-5" }, { "category": "external", "summary": "Arch Linux Security Advisory ASA-202110-4 vom 2021-10-21", "url": "https://security.archlinux.org/ASA-202110-4" }, { "category": "external", "summary": "Arch Linux Security Advisory ASA-202110-6 vom 2021-10-21", "url": "https://security.archlinux.org/ASA-202110-6" }, { "category": "external", "summary": "Node.js October 2021 Security Releases vom 2021-10-12", "url": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:3886-1 vom 2021-12-02", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-December/009816.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:3940-1 vom 2021-12-06", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-December/009853.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2021:3964-1 vom 2021-12-07", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-December/009869.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2021-5171 vom 2021-12-16", "url": "http://linux.oracle.com/errata/ELSA-2021-5171.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:5171 vom 2021-12-16", "url": "https://access.redhat.com/errata/RHSA-2021:5171" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0041 vom 2022-01-06", "url": "https://access.redhat.com/errata/RHSA-2022:0041" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:0101-1 vom 2022-01-18", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-January/010017.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0246 vom 2022-01-25", "url": "https://access.redhat.com/errata/RHSA-2022:0246" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-013 vom 2022-01-27", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-013.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:4914 vom 2022-06-06", "url": "https://access.redhat.com/errata/RHSA-2022:4914" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2022:0350 vom 2022-02-02", "url": "https://access.redhat.com/errata/RHSA-2022:0350" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2022-0350 vom 2022-02-02", "url": "http://linux.oracle.com/errata/ELSA-2022-0350.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5170 vom 2022-06-27", "url": "https://lists.debian.org/debian-security-announce/2022/msg00138.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2022:2855-1 vom 2022-08-19", "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-August/011954.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2022-214 vom 2022-12-09", "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-214.html" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202405-29 vom 2024-05-08", "url": "https://security.gentoo.org/glsa/202405-29" } ], "source_lang": "en-US", "title": "Node.js: Mehrere Schwachstellen erm\u00f6glichen \"HTTP request smuggling\"", "tracking": { "current_release_date": "2024-05-09T22:00:00.000+00:00", "generator": { "date": "2024-05-10T09:04:19.208+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-0093", "initial_release_date": "2021-10-12T22:00:00.000+00:00", "revision_history": [ { "date": "2021-10-12T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2021-10-17T22:00:00.000+00:00", "number": "2", "summary": "Referenz(en) aufgenommen: FEDORA-2021-9818CABE0D" }, { "date": "2021-10-21T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Arch Linux aufgenommen" }, { "date": "2021-12-02T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-12-06T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-12-07T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2021-12-16T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen" }, { "date": "2022-01-06T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-01-18T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-01-24T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-01-27T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2022-02-01T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-02-02T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2022-06-06T22:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-06-27T22:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2022-08-21T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2022-12-11T23:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2024-05-09T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Gentoo aufgenommen" } ], "status": "final", "version": "18" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "Open Source Arch Linux", "product": { "name": "Open Source Arch Linux", "product_id": "T013312", "product_identification_helper": { "cpe": "cpe:/o:archlinux:archlinux:-" } } }, { "branches": [ { "category": "product_version", "name": "12.x", "product": { "name": "Open Source Node.js 12.x", "product_id": "T019652", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:12.x" } } }, { "category": "product_version", "name": "14.x", "product": { "name": "Open Source Node.js 14.x", "product_id": "T019653", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:14.x" } } }, { "category": "product_version", "name": "16.x", "product": { "name": "Open Source Node.js 16.x", "product_id": "T019654", "product_identification_helper": { "cpe": "cpe:/a:nodejs:nodejs:16.x" } } } ], "category": "product_name", "name": "Node.js" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-22959", "notes": [ { "category": "description", "text": "In Node.js existieren mehrere Schwachstellen im http Parser. Chunked requests und Header-Namen mit Leerzeichen werden nicht ordnungsgem\u00e4\u00df verarbeitet. Ein Angreifer kann dieses zu einem \"HTTP request smuggling\" nutzen und in der Folge u. a. Sicherheitsmechanismen umgehen, Daten manipulieren oder Authentisierungsmerkmale stehlen." } ], "product_status": { "known_affected": [ "T019654", "T019653", "2951", "T002207", "67646", "T013312", "398363", "T012167", "T004914", "T019652" ] }, "release_date": "2021-10-12T22:00:00Z", "title": "CVE-2021-22959" }, { "cve": "CVE-2021-22960", "notes": [ { "category": "description", "text": "In Node.js existieren mehrere Schwachstellen im http Parser. Chunked requests und Header-Namen mit Leerzeichen werden nicht ordnungsgem\u00e4\u00df verarbeitet. Ein Angreifer kann dieses zu einem \"HTTP request smuggling\" nutzen und in der Folge u. a. Sicherheitsmechanismen umgehen, Daten manipulieren oder Authentisierungsmerkmale stehlen." } ], "product_status": { "known_affected": [ "T019654", "T019653", "2951", "T002207", "67646", "T013312", "398363", "T012167", "T004914", "T019652" ] }, "release_date": "2021-10-12T22:00:00Z", "title": "CVE-2021-22960" } ] }
gsd-2021-22959
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2021-22959", "description": "The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp \u003c v2.1.4 and \u003c v6.0.6.", "id": "GSD-2021-22959", "references": [ "https://www.suse.com/security/cve/CVE-2021-22959.html", "https://access.redhat.com/errata/RHSA-2022:0350", "https://access.redhat.com/errata/RHSA-2022:0246", "https://access.redhat.com/errata/RHSA-2022:0041", "https://access.redhat.com/errata/RHSA-2021:5171", "https://advisories.mageia.org/CVE-2021-22959.html", "https://security.archlinux.org/CVE-2021-22959", "https://linux.oracle.com/cve/CVE-2021-22959.html", "https://access.redhat.com/errata/RHSA-2022:4914", "https://www.debian.org/security/2022/dsa-5170", "https://access.redhat.com/errata/RHEA-2022:4925", "https://access.redhat.com/errata/RHEA-2022:5139", "https://access.redhat.com/errata/RHEA-2022:5221", "https://access.redhat.com/errata/RHEA-2022:5615" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2021-22959" ], "details": "The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp \u003c v2.1.4 and \u003c v6.0.6.", "id": "GSD-2021-22959", "modified": "2023-12-13T01:23:24.199933Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "support@hackerone.com", "ID": "CVE-2021-22959", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "https://github.com/nodejs/llhttp", "version": { "version_data": [ { "version_value": "Fixed in llhttp v2.1.4 and v6.0.6" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp \u003c v2.1.4 and \u003c v6.0.6." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "HTTP Request Smuggling (CWE-444)" } ] } ] }, "references": { "reference_data": [ { "name": "https://hackerone.com/reports/1238709", "refsource": "MISC", "url": "https://hackerone.com/reports/1238709" }, { "name": "https://www.oracle.com/security-alerts/cpujan2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "name": "DSA-5170", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2022/dsa-5170" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "\u003c2.1.4||\u003e=3.0.0 \u003c6.0.6", "affected_versions": "All versions before 2.1.4, all versions starting from 3.0.0 before 6.0.6", "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "cwe_ids": [ "CWE-1035", "CWE-444", "CWE-937" ], "date": "2022-12-09", "description": "The llhttp parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS).", "fixed_versions": [ "2.1.4", "6.0.6" ], "identifier": "CVE-2021-22959", "identifiers": [ "CVE-2021-22959" ], "not_impacted": "All versions starting from 2.1.4 before 3.0.0, all versions starting from 6.0.6", "package_slug": "npm/llhttp", "pubdate": "2021-11-15", "solution": "Upgrade to version 2.1.4, 6.0.6 or above.", "title": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request Smuggling\u0027)", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-22959", "https://hackerone.com/reports/1238709" ], "uuid": "f2d31d1d-c33a-4059-a8ce-756c3f9ab4a5" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*", "cpe_name": [], "versionEndExcluding": "2.1.4", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*", "cpe_name": [], "versionEndExcluding": "6.0.6", "versionStartIncluding": "3.0.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:oracle:graalvm:21.3.0:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:graalvm:20.3.4:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve-assignments@hackerone.com", "ID": "CVE-2021-22959" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp \u003c v2.1.4 and \u003c v6.0.6." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-444" } ] } ] }, "references": { "reference_data": [ { "name": "https://hackerone.com/reports/1238709", "refsource": "MISC", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ], "url": "https://hackerone.com/reports/1238709" }, { "name": "https://www.oracle.com/security-alerts/cpujan2022.html", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "name": "DSA-5170", "refsource": "DEBIAN", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://www.debian.org/security/2022/dsa-5170" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 2.5 } }, "lastModifiedDate": "2022-12-09T16:14Z", "publishedDate": "2021-11-15T15:15Z" } } }
ghsa-mhxq-vjjq-pcvf
Vulnerability from github
Published
2022-05-24 19:20
Modified
2022-05-24 19:20
Severity ?
Details
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
{ "affected": [], "aliases": [ "CVE-2021-22959" ], "database_specific": { "cwe_ids": [ "CWE-444" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2021-11-15T15:15:00Z", "severity": "MODERATE" }, "details": "The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp \u003c v2.1.4 and \u003c v6.0.6.", "id": "GHSA-mhxq-vjjq-pcvf", "modified": "2022-05-24T19:20:57Z", "published": "2022-05-24T19:20:57Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959" }, { "type": "WEB", "url": "https://hackerone.com/reports/1238709" }, { "type": "WEB", "url": "https://www.debian.org/security/2022/dsa-5170" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.