[ALSA-2023:5362] Important: nodejs:18 security, bug fix, and enhancement update
Type:
security
Severity:
important
Release date:
2023-09-27
Description:
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2234409) Security Fix(es): * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002) * nodejs-semver: Regular expression denial of service (CVE-2022-25883) * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006) * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 nodejs-devel-18.17.1-1.module_el8.8.0+3613+1ed8c91d.aarch64.rpm 392f036b977c2fef75007e469a4da03175bd166891db69c1675adc1fcec93961
aarch64 nodejs-full-i18n-18.17.1-1.module_el8.8.0+3613+1ed8c91d.aarch64.rpm 5a518266546c9ee53c0cf9f10aaaef9933b29e52b95441de5d693a71adb6d0ed
aarch64 npm-9.6.7-1.18.17.1.1.module_el8.8.0+3613+1ed8c91d.aarch64.rpm 98275b61292b81d30a5a74b55d2ec570dacf7a3686c7b73430e2d9edd4d768ae
aarch64 nodejs-18.17.1-1.module_el8.8.0+3613+1ed8c91d.aarch64.rpm aba6d035b69493ff75a2996b7dc365010aae53af75b3516082fa858a81495f54
noarch nodejs-nodemon-3.0.1-1.module_el8.8.0+3613+1ed8c91d.noarch.rpm 1de153a1170baeaa24f02ebd86d32d508ac48ea9ed54e2a70c5250a81952a65b
noarch nodejs-docs-18.17.1-1.module_el8.8.0+3613+1ed8c91d.noarch.rpm 84153ed813b0358ecd3979b9a5619cbaf475a7bd8b48e79725a178e290ed17f3
noarch nodejs-packaging-2021.06-4.module_el8.7.0+3343+ea2b7901.noarch.rpm 9430d44c78a3cfbe1ae3d39b8531f651606661943959bc0c3de87b2f91ea6f67
noarch nodejs-packaging-bundler-2021.06-4.module_el8.7.0+3343+ea2b7901.noarch.rpm dca36d100028686323583aeddaa86efff902ff7fe29cb97d4356c309e3e899d9
ppc64le nodejs-18.17.1-1.module_el8.8.0+3613+1ed8c91d.ppc64le.rpm 37c9bb2a54c5b981c751a9b1362c7c1c475e8795aa2fa59dc3e74e443312b976
ppc64le nodejs-devel-18.17.1-1.module_el8.8.0+3613+1ed8c91d.ppc64le.rpm a34eb67bc3b266d399e77b3d1af742cac34727812ade00ccd8b89d9938e285a8
ppc64le npm-9.6.7-1.18.17.1.1.module_el8.8.0+3613+1ed8c91d.ppc64le.rpm dd6b230b4ce492bb63cab17efd8ee78da53831aead22c6f9e5dd61a1ba38d834
ppc64le nodejs-full-i18n-18.17.1-1.module_el8.8.0+3613+1ed8c91d.ppc64le.rpm fa31714226abd3dd0640e8fd92f97d8091decd2d60edac2cdb81ac10ce4a1d4c
s390x nodejs-18.17.1-1.module_el8.8.0+3613+1ed8c91d.s390x.rpm 0a25d76c346c49e639022052ad8517e29d1b95ce843a92ee0e499fee71c9ec85
s390x nodejs-devel-18.17.1-1.module_el8.8.0+3613+1ed8c91d.s390x.rpm 2eaf8c6355a7463b03669c6745dcdb47e55249caed7b003313015f71377a1328
s390x npm-9.6.7-1.18.17.1.1.module_el8.8.0+3613+1ed8c91d.s390x.rpm b9864416f4907b029718d7a0b89a98d6a620a2536d9e21d41e0ad0b7e9333dbb
s390x nodejs-full-i18n-18.17.1-1.module_el8.8.0+3613+1ed8c91d.s390x.rpm bb4fba6745e4aef5a41cce68a488645a07b65bc618b6bd476d6a5df5763d3b64
x86_64 nodejs-full-i18n-18.17.1-1.module_el8.8.0+3613+1ed8c91d.x86_64.rpm 121f06bcd69713e5c1c62b01af4df7345fb9b066b3a15aff8843178d13e75c8c
x86_64 nodejs-devel-18.17.1-1.module_el8.8.0+3613+1ed8c91d.x86_64.rpm 5b2515c3e6da48c9333210af65a26e476dee22489a987f736d89cbb7b44e54ad
x86_64 npm-9.6.7-1.18.17.1.1.module_el8.8.0+3613+1ed8c91d.x86_64.rpm 6af070351a9711d2a9c2f8a7d1fd93fd2ba91958db3db4307b8dcf28068d4cbd
x86_64 nodejs-18.17.1-1.module_el8.8.0+3613+1ed8c91d.x86_64.rpm 98097499477f13ae020ad772da61225456a6d23411daecec2e8e772f776eed66
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.