RHSA-2021:3638: Important: nodejs:12 security and bug fix update
First published: Wed Sep 22 2021(Updated: )
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. <br>The following packages have been upgraded to a later upstream version: nodejs (12.22.5). (BZ#1994939)<br>Security Fix(es):<br><li> nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)</li> <li> nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)</li> <li> c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)</li> <li> nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)</li> <li> nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)</li> <li> nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)</li> <li> nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)</li> <li> nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)</li> <li> libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)</li> <li> nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)</li> <li> nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> nodejs:12/nodejs: Make FIPS options always available (BZ#1993928)</li>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/nodejs | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-nodemon | <1.18.3-1.module+el8.1.0+3369+37ae6a45 | 1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| redhat/nodejs-packaging | <17-3.module+el8.1.0+3369+37ae6a45 | 17-3.module+el8.1.0+3369+37ae6a45 |
| redhat/nodejs-docs | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-nodemon | <1.18.3-1.module+el8.1.0+3369+37ae6a45 | 1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| redhat/nodejs-packaging | <17-3.module+el8.1.0+3369+37ae6a45 | 17-3.module+el8.1.0+3369+37ae6a45 |
| redhat/nodejs | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-debuginfo | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-debugsource | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-devel | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-full-i18n | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/npm | <6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b | 6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-debuginfo | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-debugsource | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-devel | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-full-i18n | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/npm | <6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b | 6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-debuginfo | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-debugsource | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-devel | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs-full-i18n | <12.22.5-1.module+el8.2.0+12241+a3db445b | 12.22.5-1.module+el8.2.0+12241+a3db445b |
| redhat/npm | <6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b | 6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b |
| redhat/nodejs | <12.22.5-1.module+el8.2.0+12241+a3db445b.aa | 12.22.5-1.module+el8.2.0+12241+a3db445b.aa |
| redhat/nodejs-debuginfo | <12.22.5-1.module+el8.2.0+12241+a3db445b.aa | 12.22.5-1.module+el8.2.0+12241+a3db445b.aa |
| redhat/nodejs-debugsource | <12.22.5-1.module+el8.2.0+12241+a3db445b.aa | 12.22.5-1.module+el8.2.0+12241+a3db445b.aa |
| redhat/nodejs-devel | <12.22.5-1.module+el8.2.0+12241+a3db445b.aa | 12.22.5-1.module+el8.2.0+12241+a3db445b.aa |
| redhat/nodejs-full-i18n | <12.22.5-1.module+el8.2.0+12241+a3db445b.aa | 12.22.5-1.module+el8.2.0+12241+a3db445b.aa |
| redhat/npm | <6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b.aa | 6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b.aa |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1941471
- https://bugzilla.redhat.com/show_bug.cgi?id=1943208
- https://bugzilla.redhat.com/show_bug.cgi?id=1956818
- https://bugzilla.redhat.com/show_bug.cgi?id=1979338
- https://bugzilla.redhat.com/show_bug.cgi?id=1988342
- https://bugzilla.redhat.com/show_bug.cgi?id=1988394
- https://bugzilla.redhat.com/show_bug.cgi?id=1990409
- https://bugzilla.redhat.com/show_bug.cgi?id=1990415
- https://bugzilla.redhat.com/show_bug.cgi?id=1993019
- https://bugzilla.redhat.com/show_bug.cgi?id=1993029
- https://bugzilla.redhat.com/show_bug.cgi?id=1993039
- https://bugzilla.redhat.com/show_bug.cgi?id=1993928
- https://access.redhat.com/security/updates/classification/#important
- https://access.redhat.com/errata/RHSA-2021:3638 (Advisory)
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- agent/weakness
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2021:3638
- agent/software-canonical-lookup
- package-manager/redhat