csaf_redhat - rhsa-2023

rhsa-2023_5360

Vulnerability from csaf_redhat

Published

2023-09-26 14:59

Modified

2024-12-17 22:25

Summary

Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Notes

Topic

An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (16). (BZ#2233891) Security Fix(es): * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002) * nodejs-semver: Regular expression denial of service (CVE-2022-25883) * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006) * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * nodejs:16/nodejs: nodejs.prov doesn't generate the bundled dependency for modules starting @ like @colors/colors (BZ#2237394)

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for the nodejs:16 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16). (BZ#2233891)\n\nSecurity Fix(es):\n\n* nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)\n\n* nodejs-semver: Regular expression denial of service (CVE-2022-25883)\n\n* nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006)\n\n* nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: nodejs.prov doesn't generate the bundled dependency for modules starting @ like @colors/colors (BZ#2237394)",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2023:5360",
            url: "https://access.redhat.com/errata/RHSA-2023:5360",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "2216475",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2216475",
         },
         {
            category: "external",
            summary: "2230948",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230948",
         },
         {
            category: "external",
            summary: "2230955",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230955",
         },
         {
            category: "external",
            summary: "2230956",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230956",
         },
         {
            category: "external",
            summary: "2233891",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2233891",
         },
         {
            category: "external",
            summary: "2237394",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2237394",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5360.json",
         },
      ],
      title: "Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update",
      tracking: {
         current_release_date: "2024-12-17T22:25:20+00:00",
         generator: {
            date: "2024-12-17T22:25:20+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.3",
            },
         },
         id: "RHSA-2023:5360",
         initial_release_date: "2023-09-26T14:59:37+00:00",
         revision_history: [
            {
               date: "2023-09-26T14:59:37+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2023-09-26T14:59:37+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-12-17T22:25:20+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux AppStream (v. 8)",
                        product: {
                           name: "Red Hat Enterprise Linux AppStream (v. 8)",
                           product_id: "AppStream-8.8.0.Z.MAIN.EUS",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:enterprise_linux:8::appstream",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Enterprise Linux",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs:16:8080020230906092006:63b34585",
                        product: {
                           name: "nodejs:16:8080020230906092006:63b34585",
                           product_id: "nodejs:16:8080020230906092006:63b34585",
                           product_identification_helper: {
                              purl: "pkg:rpmmod/redhat/nodejs@16:8080020230906092006:63b34585",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                        product: {
                           name: "nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                           product_id: "nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-docs@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=noarch&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                        product: {
                           name: "nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                           product_id: "nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel8.8.0%2B19764%2B7eed1ca3?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                        product: {
                           name: "nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                           product_id: "nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-packaging@26-1.module%2Bel8.8.0%2B19857%2B6d2a104d?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                        product: {
                           name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_id: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=aarch64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                        product: {
                           name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_id: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debuginfo@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=aarch64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                        product: {
                           name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_id: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debugsource@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=aarch64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                        product: {
                           name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_id: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-devel@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=aarch64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                        product: {
                           name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_id: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-full-i18n@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=aarch64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                        product: {
                           name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_id: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/npm@8.19.4-1.16.20.2.2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=aarch64&epoch=1",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                        product: {
                           name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                           product_id: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=src&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                        product: {
                           name: "nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                           product_id: "nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-nodemon@3.0.1-1.module%2Bel8.8.0%2B19764%2B7eed1ca3?arch=src",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                        product: {
                           name: "nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                           product_id: "nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-packaging@26-1.module%2Bel8.8.0%2B19857%2B6d2a104d?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                        product: {
                           name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_id: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                        product: {
                           name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_id: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debuginfo@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                        product: {
                           name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_id: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debugsource@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                        product: {
                           name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_id: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-devel@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                        product: {
                           name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_id: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-full-i18n@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                        product: {
                           name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_id: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/npm@8.19.4-1.16.20.2.2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=ppc64le&epoch=1",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                        product: {
                           name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_id: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=s390x&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                        product: {
                           name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_id: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debuginfo@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=s390x&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                        product: {
                           name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_id: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debugsource@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=s390x&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                        product: {
                           name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_id: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-devel@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=s390x&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                        product: {
                           name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_id: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-full-i18n@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=s390x&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                        product: {
                           name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_id: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/npm@8.19.4-1.16.20.2.2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=s390x&epoch=1",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                        product: {
                           name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_id: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=x86_64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                        product: {
                           name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_id: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debuginfo@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=x86_64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                        product: {
                           name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_id: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-debugsource@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=x86_64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                        product: {
                           name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_id: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-devel@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=x86_64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                        product: {
                           name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_id: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/nodejs-full-i18n@16.20.2-2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=x86_64&epoch=1",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
                        product: {
                           name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_id: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/npm@8.19.4-1.16.20.2.2.module%2Bel8.8.0%2B19898%2Bab99ba34?arch=x86_64&epoch=1",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
            },
            product_reference: "nodejs:16:8080020230906092006:63b34585",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
            },
            product_reference: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
            },
            product_reference: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
            },
            product_reference: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
            },
            product_reference: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
            },
            product_reference: "nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
            },
            product_reference: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
            },
            product_reference: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
            },
            product_reference: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
            },
            product_reference: "nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
            },
            product_reference: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
            },
            product_reference: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
            },
            product_reference: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
            },
            product_reference: "nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
            },
            product_reference: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
            },
            product_reference: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
            },
            product_reference: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
            },
            product_reference: "nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
            },
            product_reference: "nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
            },
            product_reference: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
            },
            product_reference: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
            },
            product_reference: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
            },
            product_reference: "nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
            },
            product_reference: "nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
            },
            product_reference: "nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
            },
            product_reference: "nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
            },
            product_reference: "nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
            },
            product_reference: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
            },
            product_reference: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
            },
            product_reference: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64 as a component of nodejs:16:8080020230906092006:63b34585 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
            },
            product_reference: "npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
            relates_to_product_reference: "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2022-25883",
         cwe: {
            id: "CWE-1333",
            name: "Inefficient Regular Expression Complexity",
         },
         discovery_date: "2023-06-21T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2216475",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in node-semver package via the 'new Range' function. This issue could allow an attacker to pass untrusted malicious regex user data as a range, causing the service to excessively consume CPU depending upon the input size, resulting in a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs-semver: Regular expression denial of service",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat Advanced Cluster Management for Kubernetes-2 and Red Hat Advanced Cluster Security-3 has been marked as Low severity because node-semver is a Dev dependency for those, used only during the build process, and not used in customer environments.\n\nIn Red Hat Advanced Cluster Management for Kubernetes (RHACM) the server-regexp dependency is protected by OAuth what is reducing impact by this flaw to Low.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2022-25883",
            },
            {
               category: "external",
               summary: "RHBZ#2216475",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2216475",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2022-25883",
               url: "https://www.cve.org/CVERecord?id=CVE-2022-25883",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2022-25883",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2022-25883",
            },
            {
               category: "external",
               summary: "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
               url: "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
            },
            {
               category: "external",
               summary: "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795",
               url: "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795",
            },
         ],
         release_date: "2023-06-21T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:59:37+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5360",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "nodejs-semver: Regular expression denial of service",
      },
      {
         cve: "CVE-2023-32002",
         cwe: {
            id: "CWE-1268",
            name: "Policy Privileges are not Assigned Consistently Between Control and Data Agents",
         },
         discovery_date: "2023-08-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2230948",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in NodeJS. This security issue occurs as the use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs: Permissions policies can be bypassed via Module._load",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This CVE marked as important as the permissions policies can be bypassed using via Module._load() functionality.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-32002",
            },
            {
               category: "external",
               summary: "RHBZ#2230948",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230948",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-32002",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-32002",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-32002",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-32002",
            },
            {
               category: "external",
               summary: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002",
               url: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002",
            },
         ],
         release_date: "2023-08-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:59:37+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5360",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "nodejs: Permissions policies can be bypassed via Module._load",
      },
      {
         cve: "CVE-2023-32006",
         cwe: {
            id: "CWE-213",
            name: "Exposure of Sensitive Information Due to Incompatible Policies",
         },
         discovery_date: "2023-08-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2230955",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in NodeJS. This security issue occurs as the use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-32006",
            },
            {
               category: "external",
               summary: "RHBZ#2230955",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230955",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-32006",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-32006",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-32006",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-32006",
            },
            {
               category: "external",
               summary: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006",
               url: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006",
            },
         ],
         release_date: "2023-08-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:59:37+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5360",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "LOW",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()",
      },
      {
         cve: "CVE-2023-32559",
         cwe: {
            id: "CWE-94",
            name: "Improper Control of Generation of Code ('Code Injection')",
         },
         discovery_date: "2023-08-10T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2230956",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') to run arbitrary code outside of the limits defined in a policy.json file.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nodejs: Permissions policies can be bypassed via process.binding",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "It's important to emphasize that when this CVE was reported, the policy feature in Node.js was in its experimental stage.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
               "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-32559",
            },
            {
               category: "external",
               summary: "RHBZ#2230956",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2230956",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-32559",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-32559",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-32559",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-32559",
            },
            {
               category: "external",
               summary: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-processbinding-mediumcve-2023-32559",
               url: "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-processbinding-mediumcve-2023-32559",
            },
         ],
         release_date: "2023-08-09T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2023-09-26T14:59:37+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2023:5360",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debuginfo-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-debugsource-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-devel-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-docs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-full-i18n-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.x86_64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-nodemon-0:3.0.1-1.module+el8.8.0+19764+7eed1ca3.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.noarch",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:nodejs-packaging-0:26-1.module+el8.8.0+19857+6d2a104d.src",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.aarch64",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.ppc64le",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.s390x",
                  "AppStream-8.8.0.Z.MAIN.EUS:nodejs:16:8080020230906092006:63b34585:npm-1:8.19.4-1.16.20.2.2.module+el8.8.0+19898+ab99ba34.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "nodejs: Permissions policies can be bypassed via process.binding",
      },
   ],
}

cve-2023-32002

Vulnerability from cvelistv5

Published

2023-08-21 16:52

Modified

2025-02-13 16:50

Severity ?

Summary

The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

References

▼	URL	Tags
	https://hackerone.com/reports/1960870
	https://security.netapp.com/advisory/ntap-20230915-0009/

Impacted products

	Vendor	Product	Version
	Node.js	Node.js	Version: 20.5.0 ≤ 20.5.0 Version: 18.17.0 ≤ 18.17.0 Version: 16.20.1 ≤ 16.20.1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:03:28.656Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/1960870",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20230915-0009/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "nodejs",
                  vendor: "nodejs",
                  versions: [
                     {
                        lessThanOrEqual: "16.20.1",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                     {
                        lessThanOrEqual: "18.17.0",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                     {
                        lessThanOrEqual: "20.5.0",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-32002",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-11T00:00:00+00:00",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-288",
                        description: "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T04:55:46.694Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Node.js",
               vendor: "Node.js",
               versions: [
                  {
                     lessThanOrEqual: "20.5.0",
                     status: "affected",
                     version: "20.5.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "18.17.0",
                     status: "affected",
                     version: "18.17.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "16.20.1",
                     status: "affected",
                     version: "16.20.1",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-09-15T13:06:27.101Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://hackerone.com/reports/1960870",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20230915-0009/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-32002",
      datePublished: "2023-08-21T16:52:42.147Z",
      dateReserved: "2023-05-01T01:00:12.220Z",
      dateUpdated: "2025-02-13T16:50:16.650Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-32006

Vulnerability from cvelistv5

Published

2023-08-15 15:10

Modified

2025-02-13 16:50

Severity ?

Summary

The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

References

▼	URL	Tags
	https://hackerone.com/reports/2043807
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/
	https://security.netapp.com/advisory/ntap-20230915-0009/

Impacted products

	Vendor	Product	Version
	Node.js	Node.js	Version: 20.5.0 ≤ 20.5.0 Version: 18.17.0 ≤ 18.17.0 Version: 16.20.1 ≤ 16.20.1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:03:28.787Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/2043807",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20230915-0009/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-32006",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-08T20:20:48.763469Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-08T20:21:00.388Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Node.js",
               vendor: "Node.js",
               versions: [
                  {
                     lessThanOrEqual: "20.5.0",
                     status: "affected",
                     version: "20.5.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "18.17.0",
                     status: "affected",
                     version: "18.17.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "16.20.1",
                     status: "affected",
                     version: "16.20.1",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-09-15T13:06:28.688Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://hackerone.com/reports/2043807",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/",
            },
            {
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20230915-0009/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-32006",
      datePublished: "2023-08-15T15:10:09.447Z",
      dateReserved: "2023-05-01T01:00:12.220Z",
      dateUpdated: "2025-02-13T16:50:18.952Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-25883

Vulnerability from cvelistv5

Published

2023-06-21 05:00

Modified

2024-12-06 16:55

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P

Summary

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

References

▼	URL	Tags
	https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
	https://github.com/npm/node-semver/blob/main/internal/re.js%23L160
	https://github.com/npm/node-semver/blob/main/internal/re.js%23L138
	https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
	https://github.com/npm/node-semver/pull/564
	https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441

Impacted products

	Vendor	Product	Version
	n/a	semver	Version: 0 ≤

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-10-25T13:07:28.542Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/node-semver/blob/main/internal/re.js%23L160",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/node-semver/blob/main/internal/re.js%23L138",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/node-semver/pull/564",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441",
               },
               {
                  url: "https://security.netapp.com/advisory/ntap-20241025-0004/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-25883",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-12-06T16:54:52.064322Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-1333",
                        description: "CWE-1333 Inefficient Regular Expression Complexity",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-12-06T16:55:09.228Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "semver",
               vendor: "n/a",
               versions: [
                  {
                     lessThan: "7.5.2",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Alessio Della Libera - Snyk Research Team",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\r\r\r",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-1333",
                     description: "Regular Expression Denial of Service (ReDoS)",
                     lang: "en",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-06-21T05:00:03.352Z",
            orgId: "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
            shortName: "snyk",
         },
         references: [
            {
               url: "https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795",
            },
            {
               url: "https://github.com/npm/node-semver/blob/main/internal/re.js%23L160",
            },
            {
               url: "https://github.com/npm/node-semver/blob/main/internal/re.js%23L138",
            },
            {
               url: "https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104",
            },
            {
               url: "https://github.com/npm/node-semver/pull/564",
            },
            {
               url: "https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
      assignerShortName: "snyk",
      cveId: "CVE-2022-25883",
      datePublished: "2023-06-21T05:00:03.352Z",
      dateReserved: "2022-02-24T11:58:25.192Z",
      dateUpdated: "2024-12-06T16:55:09.228Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-32559

Vulnerability from cvelistv5

Published

2023-08-24 01:23

Modified

2025-02-13 16:54

Severity ?

Summary

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

References

▼	URL	Tags
	https://hackerone.com/reports/1946470
	https://security.netapp.com/advisory/ntap-20231006-0006/

Impacted products

	Vendor	Product	Version
	Node.js	Node.js	Version: 20.5.0 ≤ 20.5.0 Version: 18.17.0 ≤ 18.17.0 Version: 16.20.1 ≤ 16.20.1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:18:37.607Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/1946470",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20231006-0006/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "nodejs",
                  vendor: "nodejs",
                  versions: [
                     {
                        lessThan: "16.20.1",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                     {
                        lessThan: "18.17.0",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                     {
                        lessThan: "20.5.0",
                        status: "affected",
                        version: "0",
                        versionType: "semver",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-32559",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-03T13:34:58.374555Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-269",
                        description: "CWE-269 Improper Privilege Management",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-03T13:38:25.120Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Node.js",
               vendor: "Node.js",
               versions: [
                  {
                     lessThanOrEqual: "20.5.0",
                     status: "affected",
                     version: "20.5.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "18.17.0",
                     status: "affected",
                     version: "18.17.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "16.20.1",
                     status: "affected",
                     version: "16.20.1",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-06T14:06:39.811Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://hackerone.com/reports/1946470",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20231006-0006/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2023-32559",
      datePublished: "2023-08-24T01:23:29.038Z",
      dateReserved: "2023-05-10T01:00:12.523Z",
      dateUpdated: "2025-02-13T16:54:48.738Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2023_5360

Vulnerability from csaf_redhat

cve-2023-32002

Vulnerability from cvelistv5

cve-2023-32006

Vulnerability from cvelistv5

cve-2022-25883

Vulnerability from cvelistv5

cve-2023-32559

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature