What is the severity of RHSA-2023:1742?

The severity of RHSA-2023:1742 is categorized as Moderate based on the nature of the vulnerabilities addressed.

How do I fix RHSA-2023:1742?

To fix RHSA-2023:1742, update the affected packages to the latest version 14.21.3-1.module+el8.6.0+18532+cbe6f646.

Which software packages are affected by RHSA-2023:1742?

The affected packages include nodejs, nodejs-nodemon, nodejs-packaging, and several associated modules and debug sources.

Are there any known exploits for RHSA-2023:1742?

As of now, there are no known public exploits specifically targeting the vulnerabilities addressed in RHSA-2023:1742.

What type of vulnerabilities are addressed in RHSA-2023:1742?

RHSA-2023:1742 addresses vulnerabilities in the decode-uri-component library utilized by Node.js applications.

Vulnerability/
RHSA-2023:1742

CWE

119 20

12/4/2023

16/2/2024

RHSA-2023:1742: Important: nodejs:14 security, bug fix, and enhancement update

First published: Wed Apr 12 2023(Updated: )

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. <br>The following packages have been upgraded to a later upstream version: nodejs (14.21.3).<br>Security Fix(es):<br><li> decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)</li> <li> glob-parent: Regular Expression Denial of Service (CVE-2021-35065)</li> <li> nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)</li> <li> nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)</li> <li> nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)</li> <li> minimist: prototype pollution (CVE-2021-44906)</li> <li> node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)</li> <li> nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)</li> <li> c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)</li> <li> express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)</li> <li> http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)</li> <li> nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)</li> <li> nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)</li> <li> Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)</li> <li> nodejs: Prototype pollution via console.table properties (CVE-2022-21824)</li> <li> Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Never miss a vulnerability like this again

Reference Links

https://access.redhat.com/errata/RHSA-2023:1742 (Advisory)

Frequently Asked Questions

What is the severity of RHSA-2023:1742?
The severity of RHSA-2023:1742 is categorized as Moderate based on the nature of the vulnerabilities addressed.
How do I fix RHSA-2023:1742?
To fix RHSA-2023:1742, update the affected packages to the latest version 14.21.3-1.module+el8.6.0+18532+cbe6f646.
Which software packages are affected by RHSA-2023:1742?
The affected packages include nodejs, nodejs-nodemon, nodejs-packaging, and several associated modules and debug sources.
Are there any known exploits for RHSA-2023:1742?
As of now, there are no known public exploits specifically targeting the vulnerabilities addressed in RHSA-2023:1742.
What type of vulnerabilities are addressed in RHSA-2023:1742?
RHSA-2023:1742 addresses vulnerabilities in the decode-uri-component library utilized by Node.js applications.

agent/severity
agent/weakness
agent/type
agent/softwarecombine
agent/last-modified-date
agent/first-publish-date
agent/title
agent/description
collector/redhat-errata
source/Red Hat
anchor-id/RHSA-2023:1742
agent/software-canonical-lookup
agent/remedy
agent/references
agent/tags
agent/event
agent/source
package-manager/redhat