AlmaLinuxALSA-2023:5849

HistoryOct 18, 2023 - 12:00 a.m.

Important: nodejs:18 security update

2023-10-1800:00:00

errata.almalinux.org

node.js

security update

http/2

ddos attack

rapid reset attack

cve-2023-44487

integrity checks

cve-2023-38552

code injection

webassembly

cve-2023-39333

node-undici

cookie leakage

cve-2023-45143

unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.72 High

EPSS

Percentile

98.0%

JSON

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
nodejs: code injection via WebAssembly export names (CVE-2023-39333)
node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux9noarchnodejs-nodemon< 3.0.1-1.module_el9.2.0+36+853e48f5nodejs-nodemon-3.0.1-1.module_el9.2.0+36+853e48f5.noarch.rpm
almalinux9noarchnodejs-packaging< 2021.06-4.module_el9.1.0+13+d9a595eanodejs-packaging-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux9noarchnodejs-docs< 18.18.2-2.module_el9.2.0+43+3ebc9e20nodejs-docs-18.18.2-2.module_el9.2.0+43+3ebc9e20.noarch.rpm
almalinux9noarchnodejs-packaging-bundler< 2021.06-4.module_el9.1.0+13+d9a595eanodejs-packaging-bundler-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux9ppc64lenodejs-full-i18n< 18.18.2-2.module_el9.2.0+43+3ebc9e20nodejs-full-i18n-18.18.2-2.module_el9.2.0+43+3ebc9e20.ppc64le.rpm
almalinux9ppc64lenpm< 9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20npm-9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20.ppc64le.rpm
almalinux9ppc64lenodejs-devel< 18.18.2-2.module_el9.2.0+43+3ebc9e20nodejs-devel-18.18.2-2.module_el9.2.0+43+3ebc9e20.ppc64le.rpm
almalinux9ppc64lenodejs< 18.18.2-2.module_el9.2.0+43+3ebc9e20nodejs-18.18.2-2.module_el9.2.0+43+3ebc9e20.ppc64le.rpm
almalinux9aarch64nodejs-full-i18n< 18.18.2-2.module_el9.2.0+43+3ebc9e20nodejs-full-i18n-18.18.2-2.module_el9.2.0+43+3ebc9e20.aarch64.rpm
almalinux9aarch64npm< 9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20npm-9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	9	noarch	nodejs-nodemon	< 3.0.1-1.module_el9.2.0+36+853e48f5	nodejs-nodemon-3.0.1-1.module_el9.2.0+36+853e48f5.noarch.rpm
almalinux	9	noarch	nodejs-packaging	< 2021.06-4.module_el9.1.0+13+d9a595ea	nodejs-packaging-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux	9	noarch	nodejs-docs	< 18.18.2-2.module_el9.2.0+43+3ebc9e20	nodejs-docs-18.18.2-2.module_el9.2.0+43+3ebc9e20.noarch.rpm
almalinux	9	noarch	nodejs-packaging-bundler	< 2021.06-4.module_el9.1.0+13+d9a595ea	nodejs-packaging-bundler-2021.06-4.module_el9.1.0+13+d9a595ea.noarch.rpm
almalinux	9	ppc64le	nodejs-full-i18n	< 18.18.2-2.module_el9.2.0+43+3ebc9e20	nodejs-full-i18n-18.18.2-2.module_el9.2.0+43+3ebc9e20.ppc64le.rpm
almalinux	9	ppc64le	npm	< 9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20	npm-9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20.ppc64le.rpm
almalinux	9	ppc64le	nodejs-devel	< 18.18.2-2.module_el9.2.0+43+3ebc9e20	nodejs-devel-18.18.2-2.module_el9.2.0+43+3ebc9e20.ppc64le.rpm
almalinux	9	ppc64le	nodejs	< 18.18.2-2.module_el9.2.0+43+3ebc9e20	nodejs-18.18.2-2.module_el9.2.0+43+3ebc9e20.ppc64le.rpm
almalinux	9	aarch64	nodejs-full-i18n	< 18.18.2-2.module_el9.2.0+43+3ebc9e20	nodejs-full-i18n-18.18.2-2.module_el9.2.0+43+3ebc9e20.aarch64.rpm
almalinux	9	aarch64	npm	< 9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20	npm-9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20.aarch64.rpm