Red Hat Product Errata RHSA-2023:7205 - Security Advisory
Issued:
2023-11-14
Updated:
2023-11-14

RHSA-2023:7205 - Security Advisory

Synopsis

Important: nodejs:20 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the nodejs:20 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • nodejs: permission model improperly protects against path traversal (CVE-2023-39331)
  • nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)
  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)
  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 2242803 - CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
  • BZ - 2244104 - CVE-2023-45143 node-undici: cookie leakage
  • BZ - 2244413 - CVE-2023-39331 nodejs: permission model improperly protects against path traversal
  • BZ - 2244414 - CVE-2023-39332 nodejs: path traversal through path stored in Uint8Array
  • BZ - 2244415 - CVE-2023-38552 nodejs: integrity checks according to policies can be circumvented
  • BZ - 2244418 - CVE-2023-39333 nodejs: code injection via WebAssembly export names

Red Hat Enterprise Linux for x86_64 8

SRPM
nodejs-20.8.1-1.module+el8.9.0+20473+c4e3d824.src.rpm SHA-256: 83a9cd754acea5de5ed0d840cc3fcf683d0dea965ab6ad5b2b8adc6ff0816775
nodejs-nodemon-3.0.1-1.module+el8.9.0+20473+c4e3d824.src.rpm SHA-256: 889a030834eca2139002087753843c52252e5b2dc40b5d0ad8d87af10af3af3e
nodejs-packaging-2021.06-4.module+el8.9.0+19519+e25b965a.src.rpm SHA-256: a7fd1b3ac37949c6ce7591cd26c2b1c0a16fc981466e4ef9ba1d0fb2d54d3049
x86_64
nodejs-20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64.rpm SHA-256: 0afcc060012f21de6f764856ef969a76ecbed36d438078d00ed215044850fb1c
nodejs-debuginfo-20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64.rpm SHA-256: 954e64d106cd41c20a8ff24c91024b97f3560169d7c2f87a28380b2c0b5e071a
nodejs-debugsource-20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64.rpm SHA-256: ff05fd522431f9766d01f94684fcf97af3c3e3599a255e80f62a6c9f36a9dbae
nodejs-devel-20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64.rpm SHA-256: 938d2d59e25806ccb35afcbb33787f1db88990cd199987d6a502fe98de6f6b40
nodejs-docs-20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch.rpm SHA-256: 28df4199c585c49b61f482382f436937ae6e7f3f2139abce2fd03738f12b7bd1
nodejs-full-i18n-20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64.rpm SHA-256: 4b3c1abd5382bb2328d3bf17f3e77f1cf8e2726f1e1c680c3da80f3dbda549a4
nodejs-nodemon-3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch.rpm SHA-256: fee4b73944dd7d48743f7cb6f570393b91390ffd93f6eccb1c17b308d44e9142
nodejs-packaging-2021.06-4.module+el8.9.0+19519+e25b965a.noarch.rpm SHA-256: 66d731b4208710620bdc2be1cc05d9506201e45fce762122fd8840b7c4dca17e
nodejs-packaging-bundler-2021.06-4.module+el8.9.0+19519+e25b965a.noarch.rpm SHA-256: b7339583f645c7d80e49aadb33eb288479e3cddb1bc375fd9324c499503ca55b
npm-10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64.rpm SHA-256: ad57a4ab77793dc03e987d10bc12d53a3478c7e5d54068c2956f5026be3bbad5

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
nodejs-20.8.1-1.module+el8.9.0+20473+c4e3d824.src.rpm SHA-256: 83a9cd754acea5de5ed0d840cc3fcf683d0dea965ab6ad5b2b8adc6ff0816775
nodejs-nodemon-3.0.1-1.module+el8.9.0+20473+c4e3d824.src.rpm SHA-256: 889a030834eca2139002087753843c52252e5b2dc40b5d0ad8d87af10af3af3e
nodejs-packaging-2021.06-4.module+el8.9.0+19519+e25b965a.src.rpm SHA-256: a7fd1b3ac37949c6ce7591cd26c2b1c0a16fc981466e4ef9ba1d0fb2d54d3049
s390x
nodejs-docs-20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch.rpm SHA-256: 28df4199c585c49b61f482382f436937ae6e7f3f2139abce2fd03738f12b7bd1
nodejs-nodemon-3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch.rpm SHA-256: fee4b73944dd7d48743f7cb6f570393b91390ffd93f6eccb1c17b308d44e9142
nodejs-packaging-2021.06-4.module+el8.9.0+19519+e25b965a.noarch.rpm SHA-256: 66d731b4208710620bdc2be1cc05d9506201e45fce762122fd8840b7c4dca17e
nodejs-packaging-bundler-2021.06-4.module+el8.9.0+19519+e25b965a.noarch.rpm SHA-256: b7339583f645c7d80e49aadb33eb288479e3cddb1bc375fd9324c499503ca55b
nodejs-20.8.1-1.module+el8.9.0+20473+c4e3d824.s390x.rpm SHA-256: f9505ff1caaf2e81724c7adfdf42977bbd87267b7a0d94a20624e29934bfb0f2
nodejs-debuginfo-20.8.1-1.module+el8.9.0+20473+c4e3d824.s390x.rpm SHA-256: 17f12185c4e20dabccc82a3b7884261e09bd59c04afca537d5ae0b6702e9cb05
nodejs-debugsource-20.8.1-1.module+el8.9.0+20473+c4e3d824.s390x.rpm SHA-256: ed434d234f78e8ff8d59e18661f076335e55340df09bedcde748d2dce7c5ffd2
nodejs-devel-20.8.1-1.module+el8.9.0+20473+c4e3d824.s390x.rpm SHA-256: 8dd2b5c83b28e31e62a5c2fc6a06ba37cb8cf779ab24e70931c0846dab652ec1
nodejs-full-i18n-20.8.1-1.module+el8.9.0+20473+c4e3d824.s390x.rpm SHA-256: d25adbc0038d7114cc7b5961337c729ad59f0c80a9e4ba5a4765ea2c419e1f1d
npm-10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.s390x.rpm SHA-256: f8c0a00ff127f4ba6ba90505ef1d53dd3e5c68d259ed3b4ae12042cdc246bcbb

Red Hat Enterprise Linux for Power, little endian 8

SRPM
nodejs-20.8.1-1.module+el8.9.0+20473+c4e3d824.src.rpm SHA-256: 83a9cd754acea5de5ed0d840cc3fcf683d0dea965ab6ad5b2b8adc6ff0816775
nodejs-nodemon-3.0.1-1.module+el8.9.0+20473+c4e3d824.src.rpm SHA-256: 889a030834eca2139002087753843c52252e5b2dc40b5d0ad8d87af10af3af3e
nodejs-packaging-2021.06-4.module+el8.9.0+19519+e25b965a.src.rpm SHA-256: a7fd1b3ac37949c6ce7591cd26c2b1c0a16fc981466e4ef9ba1d0fb2d54d3049
ppc64le
nodejs-docs-20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch.rpm SHA-256: 28df4199c585c49b61f482382f436937ae6e7f3f2139abce2fd03738f12b7bd1
nodejs-nodemon-3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch.rpm SHA-256: fee4b73944dd7d48743f7cb6f570393b91390ffd93f6eccb1c17b308d44e9142
nodejs-packaging-2021.06-4.module+el8.9.0+19519+e25b965a.noarch.rpm SHA-256: 66d731b4208710620bdc2be1cc05d9506201e45fce762122fd8840b7c4dca17e
nodejs-packaging-bundler-2021.06-4.module+el8.9.0+19519+e25b965a.noarch.rpm SHA-256: b7339583f645c7d80e49aadb33eb288479e3cddb1bc375fd9324c499503ca55b
nodejs-20.8.1-1.module+el8.9.0+20473+c4e3d824.ppc64le.rpm SHA-256: ec3f3076ff6913f3819fa0cffb0e21a916c446f3dac20c4c44ee96bfccbbef37
nodejs-debuginfo-20.8.1-1.module+el8.9.0+20473+c4e3d824.ppc64le.rpm SHA-256: c53cf89f31a7f29330047fdf5b1164751e3f442d2e9c42f3d889ebfdecd91298
nodejs-debugsource-20.8.1-1.module+el8.9.0+20473+c4e3d824.ppc64le.rpm SHA-256: cb1e87a39ff46f1a9449e081a3510bae85aa1b359d5a75d9f4fdb0caccd10fae
nodejs-devel-20.8.1-1.module+el8.9.0+20473+c4e3d824.ppc64le.rpm SHA-256: ea83ff414a5b3e3cb979ebcf7065672a3eba81d70aacf0577a483e4e55360765
nodejs-full-i18n-20.8.1-1.module+el8.9.0+20473+c4e3d824.ppc64le.rpm SHA-256: e72912dd007dbc5c87202397fabf5c265a3d9fe50147c76de3484192ef226860
npm-10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.ppc64le.rpm SHA-256: da6acc3b23dea45942afdaa5ddb187df25d0962627736c8e5779c62c6d187ff1

Red Hat Enterprise Linux for ARM 64 8

SRPM
nodejs-20.8.1-1.module+el8.9.0+20473+c4e3d824.src.rpm SHA-256: 83a9cd754acea5de5ed0d840cc3fcf683d0dea965ab6ad5b2b8adc6ff0816775
nodejs-nodemon-3.0.1-1.module+el8.9.0+20473+c4e3d824.src.rpm SHA-256: 889a030834eca2139002087753843c52252e5b2dc40b5d0ad8d87af10af3af3e
nodejs-packaging-2021.06-4.module+el8.9.0+19519+e25b965a.src.rpm SHA-256: a7fd1b3ac37949c6ce7591cd26c2b1c0a16fc981466e4ef9ba1d0fb2d54d3049
aarch64
nodejs-docs-20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch.rpm SHA-256: 28df4199c585c49b61f482382f436937ae6e7f3f2139abce2fd03738f12b7bd1
nodejs-nodemon-3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch.rpm SHA-256: fee4b73944dd7d48743f7cb6f570393b91390ffd93f6eccb1c17b308d44e9142
nodejs-packaging-2021.06-4.module+el8.9.0+19519+e25b965a.noarch.rpm SHA-256: 66d731b4208710620bdc2be1cc05d9506201e45fce762122fd8840b7c4dca17e
nodejs-packaging-bundler-2021.06-4.module+el8.9.0+19519+e25b965a.noarch.rpm SHA-256: b7339583f645c7d80e49aadb33eb288479e3cddb1bc375fd9324c499503ca55b
nodejs-20.8.1-1.module+el8.9.0+20473+c4e3d824.aarch64.rpm SHA-256: db325fdc38c0643749d197c41ff941bd6712e2a8dca6f865f8e5037d0c338836
nodejs-debuginfo-20.8.1-1.module+el8.9.0+20473+c4e3d824.aarch64.rpm SHA-256: 3890e7b6bb8d256808746110ca24af8e7ebce573224eeb2935647c168369cc72
nodejs-debugsource-20.8.1-1.module+el8.9.0+20473+c4e3d824.aarch64.rpm SHA-256: daf219399b110b8bbf26a892c14eee6182a4653fabb55d22455b046cabefabd3
nodejs-devel-20.8.1-1.module+el8.9.0+20473+c4e3d824.aarch64.rpm SHA-256: 27ac1bdc96a7d9bd059908d6aa6c681982a44f6f51d6e83ac2ab0ae64c8c6d8c
nodejs-full-i18n-20.8.1-1.module+el8.9.0+20473+c4e3d824.aarch64.rpm SHA-256: 64209380dd026cb91e0fe75eed2b077247ca8a5532a75666439438c7899ba994
npm-10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.aarch64.rpm SHA-256: d9f1be8d85d69e6ccce3afea9c0ed2800a164fda63fe09291dbbb101676ea700

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.