Lucene search

K
mageiaGentoo FoundationMGASA-2024-0046
HistoryFeb 23, 2024 - 1:20 a.m.

Updated nodejs yarnpkg packages fix security vulnerabilities

2024-02-2301:20:27
Gentoo Foundation
advisories.mageia.org
14
node.js
yarnpkg
security vulnerabilities
cve-2024-21892
cve-2024-22019
cve-2023-46809
cve-2024-22025
linux capabilities
http request
dos attacks
marvin attack
resource exhaustion
fetch()

8 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

14.6%

This is a security release. The following CVEs are fixed in this release: CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High) CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) More detailed information on each of the vulnerabilities can be found in february 2024 Security Releases blog post.

OSVersionArchitecturePackageVersionFilename
Mageia9noarchnodejs< 18.19.1-1nodejs-18.19.1-1.mga9
Mageia9noarchyarnpkg< 1.22.21-0.10.2.4.1yarnpkg-1.22.21-0.10.2.4.1.mga9