Lucene search

K
redhatRedHatRHSA-2023:5532
HistoryOct 09, 2023 - 9:46 a.m.

(RHSA-2023:5532) Important: nodejs security and bug fix update

2023-10-0909:46:53
access.redhat.com
31
nodejs
security
bug fix
fast
network applications

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

39.4%

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

  • nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006)

  • nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs: Rebase to the latest Nodejs 16 release [rhel-9] (BZ#2236434)

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

39.4%