fs2-io skips mTLS client verification

Impact When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on Node.js. The JVM TLS implementation is completely...

Security Bulletin: IBM DataPower Gateway affected by vulnerability in Node (CVE-2021-44531)

Summary IBM has addressed the CVE below which may affect the APIC Gateway Service Vulnerability Details CVEID:CVE-2021-44531 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by the improper handling of URI Subject Alternative Name SAN types. An attacker...

Security Bulletin: IBM DataPower Gateway potentially affected by various vulnerabilities in Node

Summary IBM has addressed several CVEs which may affect the APIC Gateway Service Vulnerability Details CVEID:CVE-2021-44532 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by a string injection vulnerability when name constraints were used within a...

Malicious Npm Packages Tapped Again to Target Discord Users

Threat actors once again are using the node package manager npm repository to hide malware that can steal Discord tokens to monitor user sessions and steal data on the popular chat and collaboration platform, researchers have found. A campaign discovered this week by Kaspersky researchers is hidi...

fs2-io skips mTLS client verification

Impact When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on Node.js. The JVM TLS implementation is completely...

PT-2022-20593 · Fs2-Io +1 · Fs2-Io +1

Name of the Vulnerable Software and Affected Versions: fs2-io versions 3.1.0 through 3.2.10 Description: The issue arises when establishing a server-mode TLSSocket using fs2-io on Node.js, where the parameter requestCert = true is ignored, and peer certificate verification is skipped, allowing th...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to arbitrary code execution due to node.js minimist module ( CVE-2021-44906)

Summary IBM App Connect Enterprise and IBM Integration Bus are vulnerable to arbitrary code execution due to the node.js minimist module CVE-2021-44906. A mitigation has been provided for IBM Integration Bus. The latest fix packs for IBM App Connect Enterprise includes minimist 1.2.6 Vulnerabilit...

SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2022:2551-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2551-1 advisory. - A OS Command Injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost che...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for June 2022

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.2-IF012 and 21.0.3-IF010. Vulnerability Details CVEID:CVE-2021-43138 DESCRIPTION: Async could allow a remote attacker to...

Security Bulletin: IBM Cloud Pak for Security is vulnerable to Using Components with Known Vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has addressed the relevant vulnerabilities. Vulnerability Details CVEID:CVE-2022-21721 DESCRIPTION: Next.js is vulnerable to a denial of service, caused by a...

Security Bulletin: A security vulnerability in Node.js nconf affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js nconf affects IBM Cloud Automation Manager Vulnerability Details CVEID:CVE-2022-21803 DESCRIPTION: Node.js nconf module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw when using the memory...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2022-24771 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification when checking the...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2022-24772 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification when checking for...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2022-24773 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification when checking...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services. Vulnerability Details CVEID:CVE-2022-24772 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature...

Security Bulletin: A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Node.js node-forge affects IBM Cloud Pak for Multicloud Management Managed Services. Vulnerability Details CVEID:CVE-2022-24771 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature...

A OS Command Injection vulnerability exists in Node.js versions <14.20.0 <16.20.0 <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

...

The llhttp parser <v14.20.1 <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

...

file-type vulnerable to Infinite Loop via malformed MKV file

An issue was discovered in the file-type package from 13.0.0 until 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack when...

SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2022:2416-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2416-1 advisory. - A OS Command Injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost che...