{"type":"TYPE_SECURITY","shortCode":"RL","name":"RLSA-2022:6595","synopsis":"Moderate: nodejs and nodejs-nodemon security and bug fix update","severity":"SEVERITY_MODERATE","topic":"An update for nodejs and nodejs-nodemon is now available for Rocky Linux 9.\nRocky Enterprise Software Foundation Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \nThe following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","solution":null,"affectedProducts":["Rocky Linux 9"],"fixes":[{"ticket":"1907444","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=1907444","description":"CVE-2020-7788 nodejs-ini: Prototype pollution via malicious INI file"},{"ticket":"1945459","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=1945459","description":"CVE-2020-28469 nodejs-glob-parent: Regular expression denial of service"},{"ticket":"1964461","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=1964461","description":"CVE-2021-33502 nodejs-normalize-url: ReDoS for data URLs"},{"ticket":"2007557","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2007557","description":"CVE-2021-3807 nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes"},{"ticket":"2098556","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2098556","description":"CVE-2022-29244 nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace"},{"ticket":"2102001","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2102001","description":"CVE-2022-33987 nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets"},{"ticket":"2105422","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2105422","description":"CVE-2022-32212 nodejs: DNS rebinding in --inspect via invalid IP addresses"},{"ticket":"2105426","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2105426","description":"CVE-2022-32215 nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding"},{"ticket":"2105428","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2105428","description":"CVE-2022-32214 nodejs: HTTP request smuggling due to improper delimiting of header fields"},{"ticket":"2105430","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2105430","description":"CVE-2022-32213 nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding"},{"ticket":"2121019","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2121019","description":"nodejs:16\/nodejs: Rebase to the latest Nodejs 16 release [rhel-9] [rhel-9.0.0.z]"},{"ticket":"2124299","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2124299","description":"nodejs: Specify --with-default-icu-data-dir when using bootstrap build [rhel-9.0.0.z]"}],"cves":[{"name":"CVE-2021-3807","sourceBy":"Red Hat","sourceLink":"https:\/\/access.redhat.com\/hydra\/rest\/securitydata\/cve\/CVE-2021-3807.json","cvss3ScoringVector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H","cvss3BaseScore":"7.5","cwe":"CWE-400"},{"name":"CVE-2022-33987","sourceBy":"Red Hat","sourceLink":"https:\/\/access.redhat.com\/hydra\/rest\/securitydata\/cve\/CVE-2022-33987.json","cvss3ScoringVector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","cvss3BaseScore":"5.3","cwe":"CWE-601"}],"references":[],"publishedAt":"2023-01-25T21:21:29.189657Z","rpms":{},"rebootSuggested":false,"buildReferences":[]}