- Vulnerability/
- RHSA-2022:9073
RHSA-2022:9073: Moderate: nodejs:16 security, bug fix, and enhancement update
First published: Thu Dec 15 2022(Updated: )
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. <br>The following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).<br>Security Fix(es):<br><li> nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)</li> <li> nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)</li> <li> nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)</li> <li> minimist: prototype pollution (CVE-2021-44906)</li> <li> nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)</li> <li> nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)</li> <li> nodejs: Prototype pollution via console.table properties (CVE-2022-21824)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [rhel-8] (BZ#2151625)</li>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/nodejs | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-nodemon | <2.0.20-2.module+el8.7.0+17412+bb0e4a6b | 2.0.20-2.module+el8.7.0+17412+bb0e4a6b |
| redhat/nodejs-packaging | <25-1.module+el8.5.0+10992+fac5fe06 | 25-1.module+el8.5.0+10992+fac5fe06 |
| redhat/nodejs-docs | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-nodemon | <2.0.20-2.module+el8.7.0+17412+bb0e4a6b | 2.0.20-2.module+el8.7.0+17412+bb0e4a6b |
| redhat/nodejs-packaging | <25-1.module+el8.5.0+10992+fac5fe06 | 25-1.module+el8.5.0+10992+fac5fe06 |
| redhat/nodejs | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-debuginfo | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-debugsource | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-devel | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-full-i18n | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/npm | <8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 | 8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-debuginfo | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-debugsource | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-devel | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-full-i18n | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/npm | <8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 | 8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-debuginfo | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-debugsource | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-devel | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs-full-i18n | <16.18.1-3.module+el8.7.0+17465+1a1abd74 | 16.18.1-3.module+el8.7.0+17465+1a1abd74 |
| redhat/npm | <8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 | 8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 |
| redhat/nodejs | <16.18.1-3.module+el8.7.0+17465+1a1abd74.aa | 16.18.1-3.module+el8.7.0+17465+1a1abd74.aa |
| redhat/nodejs-debuginfo | <16.18.1-3.module+el8.7.0+17465+1a1abd74.aa | 16.18.1-3.module+el8.7.0+17465+1a1abd74.aa |
| redhat/nodejs-debugsource | <16.18.1-3.module+el8.7.0+17465+1a1abd74.aa | 16.18.1-3.module+el8.7.0+17465+1a1abd74.aa |
| redhat/nodejs-devel | <16.18.1-3.module+el8.7.0+17465+1a1abd74.aa | 16.18.1-3.module+el8.7.0+17465+1a1abd74.aa |
| redhat/nodejs-full-i18n | <16.18.1-3.module+el8.7.0+17465+1a1abd74.aa | 16.18.1-3.module+el8.7.0+17465+1a1abd74.aa |
| redhat/npm | <8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aa | 8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aa |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2040839
- https://bugzilla.redhat.com/show_bug.cgi?id=2040846
- https://bugzilla.redhat.com/show_bug.cgi?id=2040856
- https://bugzilla.redhat.com/show_bug.cgi?id=2040862
- https://bugzilla.redhat.com/show_bug.cgi?id=2066009
- https://bugzilla.redhat.com/show_bug.cgi?id=2134609
- https://bugzilla.redhat.com/show_bug.cgi?id=2140911
- https://bugzilla.redhat.com/show_bug.cgi?id=2142806
- https://access.redhat.com/security/updates/classification/#moderate
- https://access.redhat.com/errata/RHSA-2022:9073 (Advisory)
Frequently Asked Questions
What are the security fixes in RHSA-2022:9073?
The security updates in RHSA-2022:9073 involve newer versions of the nodejs and nodejs-nodemon packages to address vulnerabilities.
How do I remediate RHSA-2022:9073?
To fix the issues associated with RHSA-2022:9073, you should update the affected packages to their specified versions: nodejs to 16.18.1 and nodejs-nodemon to 2.0.20.
What versions are affected by RHSA-2022:9073?
The affected versions in RHSA-2022:9073 include specific builds of nodejs and nodejs-nodemon prior to their updates.
What is the package source for the updates in RHSA-2022:9073?
The updates in RHSA-2022:9073 are sourced from Red Hat for their nodejs packages.
Is upgrading nodejs and nodejs-nodemon sufficient for RHSA-2022:9073?
Yes, upgrading to nodejs version 16.18.1 and nodejs-nodemon version 2.0.20 is sufficient to remediate the vulnerabilities in RHSA-2022:9073.
- agent/references
- agent/severity
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2022:9073
- agent/software-canonical-lookup
- agent/remedy
- agent/title
- agent/description
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/redhat