Red Hat Product Errata RHSA-2024:1424 - Security Advisory
Issued:
2024-03-19
Updated:
2024-03-19

RHSA-2024:1424 - Security Advisory

Synopsis

Important: nodejs security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for nodejs is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)

A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x

Fixes

  • BZ - 2264574 - CVE-2024-22019 nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0

SRPM
nodejs-16.20.2-4.el9_0.src.rpm SHA-256: f47549fdfbe3cd2df57777a0bcabf9fbc397ddf18058991cb0ace5c459b8d5cd
x86_64
nodejs-16.20.2-4.el9_0.x86_64.rpm SHA-256: ee1e71f24d3367e1a994b337b41c4b6e9d8d190f0b06ec6fb1356b1981087821
nodejs-debuginfo-16.20.2-4.el9_0.i686.rpm SHA-256: 2d477d34dda9de78fb6446a3134e24e14bab068ec96f53fb5e45e749846ee746
nodejs-debuginfo-16.20.2-4.el9_0.x86_64.rpm SHA-256: 2bf32c52abd32f5c8173a53f3e744f882db6c16ce3a4d6ea30db93d1df148061
nodejs-debugsource-16.20.2-4.el9_0.i686.rpm SHA-256: 1c9ad08aaba943f562df5de47cbc3f474bb1af4ae5a020828a9bc5f7472f39ec
nodejs-debugsource-16.20.2-4.el9_0.x86_64.rpm SHA-256: 67a9c3085903078a5695f47117ed79bc0874466c940020e4e3b071f1e733e7e7
nodejs-docs-16.20.2-4.el9_0.noarch.rpm SHA-256: 659cb95a59206cc204d24fd056b3df384418114a367b28b01f83762f95084880
nodejs-full-i18n-16.20.2-4.el9_0.x86_64.rpm SHA-256: c68d73060bc3d68c48e5ac4337c14238acf1b6576bcab37f87cda3a730a93354
nodejs-libs-16.20.2-4.el9_0.i686.rpm SHA-256: 76f47f9fb07c35cd044c728082b9e15fd2f8006fd62a23263c7ade85cfc7a107
nodejs-libs-16.20.2-4.el9_0.x86_64.rpm SHA-256: cdbfe4204cba11c18c2fe7a4265640de35f0a89514be1e37a779f0a052b5f6f1
nodejs-libs-debuginfo-16.20.2-4.el9_0.i686.rpm SHA-256: 7c2d1caf44d0935fdf78b8f547b8a889d222ccbf7eafe1b678da50d25b63cbad
nodejs-libs-debuginfo-16.20.2-4.el9_0.x86_64.rpm SHA-256: 469b23ae07c70ffa46d6196943781101e6c925a7894f31993543d44858dc5453
npm-8.19.4-1.16.20.2.4.el9_0.x86_64.rpm SHA-256: 43498b94268b8be197994d558658877b6cae31d8ade73a99f4184ab80fc47dca

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0

SRPM
nodejs-16.20.2-4.el9_0.src.rpm SHA-256: f47549fdfbe3cd2df57777a0bcabf9fbc397ddf18058991cb0ace5c459b8d5cd
s390x
nodejs-16.20.2-4.el9_0.s390x.rpm SHA-256: 88ea42326006a2f4aeb31668c162de34e23f3cd65f532427b3b79b50c245516a
nodejs-debuginfo-16.20.2-4.el9_0.s390x.rpm SHA-256: a192eafb25caf1f705cff7aef02db8c36ff915689b33c3ee74640529ddeaa6f4
nodejs-debugsource-16.20.2-4.el9_0.s390x.rpm SHA-256: 6782b01a1c441c6f6e9057c745c3e024f79a02b3a6ae3f41f4a6f0ada0fd8a10
nodejs-docs-16.20.2-4.el9_0.noarch.rpm SHA-256: 659cb95a59206cc204d24fd056b3df384418114a367b28b01f83762f95084880
nodejs-full-i18n-16.20.2-4.el9_0.s390x.rpm SHA-256: 1e2772500d4b865ba8f83a21b4dae2f9d0007a59aa2b5bd26665e32ed4ca2ebd
nodejs-libs-16.20.2-4.el9_0.s390x.rpm SHA-256: 1c68148724960d175b4050e73275846474b0eddb819a1ab186fa16e4c941659a
nodejs-libs-debuginfo-16.20.2-4.el9_0.s390x.rpm SHA-256: 9901614e57b2c4a46f8d7acf3927ab824d7e70fbe89f15a68b4e5e992f441ab7
npm-8.19.4-1.16.20.2.4.el9_0.s390x.rpm SHA-256: 870510d65517dd9f3c4ceae7fd153068eccf665827e86496a56067595c13e698

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0

SRPM
nodejs-16.20.2-4.el9_0.src.rpm SHA-256: f47549fdfbe3cd2df57777a0bcabf9fbc397ddf18058991cb0ace5c459b8d5cd
ppc64le
nodejs-16.20.2-4.el9_0.ppc64le.rpm SHA-256: 36e70e628ef3c3d3849e3b4ae2079bb54b222ef2ed775878bfd38ec48ed70dbb
nodejs-debuginfo-16.20.2-4.el9_0.ppc64le.rpm SHA-256: 6208ac10a4170b18b4b6c25e9a824083c10df235e8ee66662a83def112a8b89f
nodejs-debugsource-16.20.2-4.el9_0.ppc64le.rpm SHA-256: 34f570c96deaa2912bd48b3576ac54025ae5d90ec2d76d7ec632184b4eb47d88
nodejs-docs-16.20.2-4.el9_0.noarch.rpm SHA-256: 659cb95a59206cc204d24fd056b3df384418114a367b28b01f83762f95084880
nodejs-full-i18n-16.20.2-4.el9_0.ppc64le.rpm SHA-256: 3876d2e6e738b1cd718781f08a24f0f9b87aee65f2f87c6617703d302bb08822
nodejs-libs-16.20.2-4.el9_0.ppc64le.rpm SHA-256: ab0937d82934bab080237eb50db830f782395aae1d30230440e16df8f7c805ca
nodejs-libs-debuginfo-16.20.2-4.el9_0.ppc64le.rpm SHA-256: eb5380cc61a82f8ed1481e9a617343c9ea4c24b9663988be78504bfe86b4c8bb
npm-8.19.4-1.16.20.2.4.el9_0.ppc64le.rpm SHA-256: 9dedb50632a4870e45cd34db61e32fa0697e8c42190453a489c17247dde01f11

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0

SRPM
nodejs-16.20.2-4.el9_0.src.rpm SHA-256: f47549fdfbe3cd2df57777a0bcabf9fbc397ddf18058991cb0ace5c459b8d5cd
aarch64
nodejs-16.20.2-4.el9_0.aarch64.rpm SHA-256: 97fb434c849557a5ba3010b9c416082ad18b7524054ec139d32bc32f236ef7e1
nodejs-debuginfo-16.20.2-4.el9_0.aarch64.rpm SHA-256: dc57115e91d45e2a24a1691a67b9e24e35596530c7d4a3c44e5b54d99ba8a9bd
nodejs-debugsource-16.20.2-4.el9_0.aarch64.rpm SHA-256: 4a1fe01c0291845b5fb2680be765788f25bc86042363bf870e4d82954a372e4d
nodejs-docs-16.20.2-4.el9_0.noarch.rpm SHA-256: 659cb95a59206cc204d24fd056b3df384418114a367b28b01f83762f95084880
nodejs-full-i18n-16.20.2-4.el9_0.aarch64.rpm SHA-256: 7a6b7a64d8ef57a80f93d5f9b7a2c2458a58b7e8448579f62240c7915dd21d9e
nodejs-libs-16.20.2-4.el9_0.aarch64.rpm SHA-256: dfabcd026d8e6df0e94f1750dd72965d3a46981ab1c1968cfe10de910f93c56c
nodejs-libs-debuginfo-16.20.2-4.el9_0.aarch64.rpm SHA-256: 34cbd14c38f363485ad75aaedc2ba9e54baf6479c5055796c35776db18fc30d1
npm-8.19.4-1.16.20.2.4.el9_0.aarch64.rpm SHA-256: 0009e0ba23eafb82f215f5c49b3b633d157712f9a568da00f3ad45ee2179b2e8

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0

SRPM
nodejs-16.20.2-4.el9_0.src.rpm SHA-256: f47549fdfbe3cd2df57777a0bcabf9fbc397ddf18058991cb0ace5c459b8d5cd
ppc64le
nodejs-16.20.2-4.el9_0.ppc64le.rpm SHA-256: 36e70e628ef3c3d3849e3b4ae2079bb54b222ef2ed775878bfd38ec48ed70dbb
nodejs-debuginfo-16.20.2-4.el9_0.ppc64le.rpm SHA-256: 6208ac10a4170b18b4b6c25e9a824083c10df235e8ee66662a83def112a8b89f
nodejs-debugsource-16.20.2-4.el9_0.ppc64le.rpm SHA-256: 34f570c96deaa2912bd48b3576ac54025ae5d90ec2d76d7ec632184b4eb47d88
nodejs-docs-16.20.2-4.el9_0.noarch.rpm SHA-256: 659cb95a59206cc204d24fd056b3df384418114a367b28b01f83762f95084880
nodejs-full-i18n-16.20.2-4.el9_0.ppc64le.rpm SHA-256: 3876d2e6e738b1cd718781f08a24f0f9b87aee65f2f87c6617703d302bb08822
nodejs-libs-16.20.2-4.el9_0.ppc64le.rpm SHA-256: ab0937d82934bab080237eb50db830f782395aae1d30230440e16df8f7c805ca
nodejs-libs-debuginfo-16.20.2-4.el9_0.ppc64le.rpm SHA-256: eb5380cc61a82f8ed1481e9a617343c9ea4c24b9663988be78504bfe86b4c8bb
npm-8.19.4-1.16.20.2.4.el9_0.ppc64le.rpm SHA-256: 9dedb50632a4870e45cd34db61e32fa0697e8c42190453a489c17247dde01f11

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0

SRPM
nodejs-16.20.2-4.el9_0.src.rpm SHA-256: f47549fdfbe3cd2df57777a0bcabf9fbc397ddf18058991cb0ace5c459b8d5cd
x86_64
nodejs-16.20.2-4.el9_0.x86_64.rpm SHA-256: ee1e71f24d3367e1a994b337b41c4b6e9d8d190f0b06ec6fb1356b1981087821
nodejs-debuginfo-16.20.2-4.el9_0.i686.rpm SHA-256: 2d477d34dda9de78fb6446a3134e24e14bab068ec96f53fb5e45e749846ee746
nodejs-debuginfo-16.20.2-4.el9_0.x86_64.rpm SHA-256: 2bf32c52abd32f5c8173a53f3e744f882db6c16ce3a4d6ea30db93d1df148061
nodejs-debugsource-16.20.2-4.el9_0.i686.rpm SHA-256: 1c9ad08aaba943f562df5de47cbc3f474bb1af4ae5a020828a9bc5f7472f39ec
nodejs-debugsource-16.20.2-4.el9_0.x86_64.rpm SHA-256: 67a9c3085903078a5695f47117ed79bc0874466c940020e4e3b071f1e733e7e7
nodejs-docs-16.20.2-4.el9_0.noarch.rpm SHA-256: 659cb95a59206cc204d24fd056b3df384418114a367b28b01f83762f95084880
nodejs-full-i18n-16.20.2-4.el9_0.x86_64.rpm SHA-256: c68d73060bc3d68c48e5ac4337c14238acf1b6576bcab37f87cda3a730a93354
nodejs-libs-16.20.2-4.el9_0.i686.rpm SHA-256: 76f47f9fb07c35cd044c728082b9e15fd2f8006fd62a23263c7ade85cfc7a107
nodejs-libs-16.20.2-4.el9_0.x86_64.rpm SHA-256: cdbfe4204cba11c18c2fe7a4265640de35f0a89514be1e37a779f0a052b5f6f1
nodejs-libs-debuginfo-16.20.2-4.el9_0.i686.rpm SHA-256: 7c2d1caf44d0935fdf78b8f547b8a889d222ccbf7eafe1b678da50d25b63cbad
nodejs-libs-debuginfo-16.20.2-4.el9_0.x86_64.rpm SHA-256: 469b23ae07c70ffa46d6196943781101e6c925a7894f31993543d44858dc5453
npm-8.19.4-1.16.20.2.4.el9_0.x86_64.rpm SHA-256: 43498b94268b8be197994d558658877b6cae31d8ade73a99f4184ab80fc47dca

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0

SRPM
nodejs-16.20.2-4.el9_0.src.rpm SHA-256: f47549fdfbe3cd2df57777a0bcabf9fbc397ddf18058991cb0ace5c459b8d5cd
aarch64
nodejs-16.20.2-4.el9_0.aarch64.rpm SHA-256: 97fb434c849557a5ba3010b9c416082ad18b7524054ec139d32bc32f236ef7e1
nodejs-debuginfo-16.20.2-4.el9_0.aarch64.rpm SHA-256: dc57115e91d45e2a24a1691a67b9e24e35596530c7d4a3c44e5b54d99ba8a9bd
nodejs-debugsource-16.20.2-4.el9_0.aarch64.rpm SHA-256: 4a1fe01c0291845b5fb2680be765788f25bc86042363bf870e4d82954a372e4d
nodejs-docs-16.20.2-4.el9_0.noarch.rpm SHA-256: 659cb95a59206cc204d24fd056b3df384418114a367b28b01f83762f95084880
nodejs-full-i18n-16.20.2-4.el9_0.aarch64.rpm SHA-256: 7a6b7a64d8ef57a80f93d5f9b7a2c2458a58b7e8448579f62240c7915dd21d9e
nodejs-libs-16.20.2-4.el9_0.aarch64.rpm SHA-256: dfabcd026d8e6df0e94f1750dd72965d3a46981ab1c1968cfe10de910f93c56c
nodejs-libs-debuginfo-16.20.2-4.el9_0.aarch64.rpm SHA-256: 34cbd14c38f363485ad75aaedc2ba9e54baf6479c5055796c35776db18fc30d1
npm-8.19.4-1.16.20.2.4.el9_0.aarch64.rpm SHA-256: 0009e0ba23eafb82f215f5c49b3b633d157712f9a568da00f3ad45ee2179b2e8

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0

SRPM
nodejs-16.20.2-4.el9_0.src.rpm SHA-256: f47549fdfbe3cd2df57777a0bcabf9fbc397ddf18058991cb0ace5c459b8d5cd
s390x
nodejs-16.20.2-4.el9_0.s390x.rpm SHA-256: 88ea42326006a2f4aeb31668c162de34e23f3cd65f532427b3b79b50c245516a
nodejs-debuginfo-16.20.2-4.el9_0.s390x.rpm SHA-256: a192eafb25caf1f705cff7aef02db8c36ff915689b33c3ee74640529ddeaa6f4
nodejs-debugsource-16.20.2-4.el9_0.s390x.rpm SHA-256: 6782b01a1c441c6f6e9057c745c3e024f79a02b3a6ae3f41f4a6f0ada0fd8a10
nodejs-docs-16.20.2-4.el9_0.noarch.rpm SHA-256: 659cb95a59206cc204d24fd056b3df384418114a367b28b01f83762f95084880
nodejs-full-i18n-16.20.2-4.el9_0.s390x.rpm SHA-256: 1e2772500d4b865ba8f83a21b4dae2f9d0007a59aa2b5bd26665e32ed4ca2ebd
nodejs-libs-16.20.2-4.el9_0.s390x.rpm SHA-256: 1c68148724960d175b4050e73275846474b0eddb819a1ab186fa16e4c941659a
nodejs-libs-debuginfo-16.20.2-4.el9_0.s390x.rpm SHA-256: 9901614e57b2c4a46f8d7acf3927ab824d7e70fbe89f15a68b4e5e992f441ab7
npm-8.19.4-1.16.20.2.4.el9_0.s390x.rpm SHA-256: 870510d65517dd9f3c4ceae7fd153068eccf665827e86496a56067595c13e698

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.