RHSA-2023:5362: Important: nodejs:18 security, bug fix, and enhancement update

Published Sep 26, 2023
·
Updated

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2234409)Security Fix(es): nodejs: Permissions policies can be bypassed via Module.load (CVE-2023-32002) nodejs-semver: Regular expression denial of service (CVE-2022-25883) nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006) nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

30 affected componentsFixes available
redhat/nodejs<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-nodemon<3.0.1-1.module+el8.8.0+19757+8ca87034
3.0.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-packaging<2021.06-4.module+el8.7.0+15582+19c314fa
2021.06-4.module+el8.7.0+15582+19c314fa
redhat/nodejs-docs<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-nodemon<3.0.1-1.module+el8.8.0+19757+8ca87034
3.0.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-packaging<2021.06-4.module+el8.7.0+15582+19c314fa
2021.06-4.module+el8.7.0+15582+19c314fa
redhat/nodejs-packaging-bundler<2021.06-4.module+el8.7.0+15582+19c314fa
2021.06-4.module+el8.7.0+15582+19c314fa
redhat/nodejs<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-debuginfo<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-debugsource<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-devel<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-full-i18n<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/npm<9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034
9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034
redhat/nodejs-debuginfo<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-debugsource<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-devel<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-full-i18n<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/npm<9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034
9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034
redhat/nodejs<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-debuginfo<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-debugsource<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-devel<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/nodejs-full-i18n<18.17.1-1.module+el8.8.0+19757+8ca87034
18.17.1-1.module+el8.8.0+19757+8ca87034
redhat/npm<9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034
9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034
redhat/nodejs<18.17.1-1.module+el8.8.0+19757+8ca87034.aa
18.17.1-1.module+el8.8.0+19757+8ca87034.aa
redhat/nodejs-debuginfo<18.17.1-1.module+el8.8.0+19757+8ca87034.aa
18.17.1-1.module+el8.8.0+19757+8ca87034.aa
redhat/nodejs-debugsource<18.17.1-1.module+el8.8.0+19757+8ca87034.aa
18.17.1-1.module+el8.8.0+19757+8ca87034.aa
redhat/nodejs-devel<18.17.1-1.module+el8.8.0+19757+8ca87034.aa
18.17.1-1.module+el8.8.0+19757+8ca87034.aa
redhat/nodejs-full-i18n<18.17.1-1.module+el8.8.0+19757+8ca87034.aa
18.17.1-1.module+el8.8.0+19757+8ca87034.aa
redhat/npm<9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034.aa
9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/nodejs to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034
  2. Upgrade

    Upgrade redhat/nodejs-nodemon to a version that resolves this vulnerability.

    Fixed in 3.0.1-1.module+el8.8.0+19757+8ca87034
  3. Upgrade

    Upgrade redhat/nodejs-packaging to a version that resolves this vulnerability.

    Fixed in 2021.06-4.module+el8.7.0+15582+19c314fa
  4. Upgrade

    Upgrade redhat/nodejs-docs to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034
  5. Upgrade

    Upgrade redhat/nodejs-packaging-bundler to a version that resolves this vulnerability.

    Fixed in 2021.06-4.module+el8.7.0+15582+19c314fa
  6. Upgrade

    Upgrade redhat/nodejs-debuginfo to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034
  7. Upgrade

    Upgrade redhat/nodejs-debugsource to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034
  8. Upgrade

    Upgrade redhat/nodejs-devel to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034
  9. Upgrade

    Upgrade redhat/nodejs-full-i18n to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034
  10. Upgrade

    Upgrade redhat/npm to a version that resolves this vulnerability.

    Fixed in 9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034
  11. Upgrade

    Upgrade redhat/nodejs to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034.aa
  12. Upgrade

    Upgrade redhat/nodejs-debuginfo to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034.aa
  13. Upgrade

    Upgrade redhat/nodejs-debugsource to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034.aa
  14. Upgrade

    Upgrade redhat/nodejs-devel to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034.aa
  15. Upgrade

    Upgrade redhat/nodejs-full-i18n to a version that resolves this vulnerability.

    Fixed in 18.17.1-1.module+el8.8.0+19757+8ca87034.aa
  16. Upgrade

    Upgrade redhat/npm to a version that resolves this vulnerability.

    Fixed in 9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034.aa
  17. Upgrade

    Upgrade nodejs to a version that resolves this vulnerability.

    Fixed in 18Patch BZ#2234409
  18. Upgrade

    Upgrade nodejs-semver to a version that resolves this vulnerability.

    Patch CVE-2022-25883
  19. Upgrade

    Upgrade nodejs to a version that resolves this vulnerability.

    Patch CVE-2023-32002
  20. Upgrade

    Upgrade nodejs to a version that resolves this vulnerability.

    Patch CVE-2023-32559
  21. Upgrade

    Upgrade nodejs to a version that resolves this vulnerability.

    Patch CVE-2023-32006

Event History

Sep 26, 2023
Advisory Published
via Red Hat·12:00 AM

Frequently Asked Questions

1

What are the key security fixes in RHSA-2023:5362?

The key security fix addresses permission vulnerabilities in Node.js.

2

How can I resolve the vulnerability identified in RHSA-2023:5362?

To resolve the vulnerability in RHSA-2023:5362, upgrade to nodejs version 18.17.1-1.module+el8.8.0+19757+8ca87034.

3

Which packages are affected by RHSA-2023:5362?

RHSA-2023:5362 impacts packages related to nodejs, including nodejs-nodemon, nodejs-packaging, and npm.

4

What is the severity level of the vulnerability in RHSA-2023:5362?

The vulnerability in RHSA-2023:5362 is categorized as a moderate severity issue.

5

Is it safe to use Node.js versions prior to the fix in RHSA-2023:5362?

Using Node.js versions prior to the fix in RHSA-2023:5362 is not recommended due to security risks.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203