Red Hat Product Errata RHSA-2024:3545 - Security Advisory
Issued:
2024-06-03
Updated:
2024-06-03

RHSA-2024:3545 - Security Advisory

Synopsis

Important: nodejs security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for nodejs is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)
  • nodejs: CONTINUATION frames DoS (CVE-2024-27983)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x

Fixes

  • BZ - 2272764 - CVE-2024-27983 nodejs: CONTINUATION frames DoS
  • BZ - 2275392 - CVE-2024-27982 nodejs: HTTP Request Smuggling via Content Length Obfuscation

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0

SRPM
nodejs-16.20.2-6.el9_0.src.rpm SHA-256: 0e718036da096ef9d9e0dc11f083d325f0743428f8c03f825d7f5df78b5e8e48
x86_64
nodejs-16.20.2-6.el9_0.x86_64.rpm SHA-256: 90a0125748d20a63973389e9c5b058797011dfd3e045ca45ded316d93403fbd5
nodejs-debuginfo-16.20.2-6.el9_0.i686.rpm SHA-256: 9aaae50bcb8e2bab15e92136bc2a2daabccea50eb9b0f061da45a1ea5dff3181
nodejs-debuginfo-16.20.2-6.el9_0.x86_64.rpm SHA-256: 6602ac2909f08252eac83bc1a8722285920fc66a38744076151a172fbf66cac2
nodejs-debugsource-16.20.2-6.el9_0.i686.rpm SHA-256: 76f263eb51877823cddaed37ff815f97ed86bedd7f7983bd7e2289caa8dfdb03
nodejs-debugsource-16.20.2-6.el9_0.x86_64.rpm SHA-256: fb3e973b27952b0b04c43a1e3ea69259a8549b0d381c3286b40d8eae52c652e9
nodejs-docs-16.20.2-6.el9_0.noarch.rpm SHA-256: 36effe5ead946adfa4ba9ada033d7dbfcbd25127b49c049b16d74825ebbe1715
nodejs-full-i18n-16.20.2-6.el9_0.x86_64.rpm SHA-256: 5d2e2d0590abc334b7b31fda9439014f78c42e0c209131bb6c2983377fa5560e
nodejs-libs-16.20.2-6.el9_0.i686.rpm SHA-256: 15e61e3252a7a75cb1a4195375e057089b14fe7945c80257a8b0f9fb3cf74195
nodejs-libs-16.20.2-6.el9_0.x86_64.rpm SHA-256: ce04719416d2256bc845c38c1c23fce6916a6cee623ddbf844c777c421639885
nodejs-libs-debuginfo-16.20.2-6.el9_0.i686.rpm SHA-256: 44d9f4db03b7137e682d8478f310efb9677c01fb51373e9fdf134a49c817efa5
nodejs-libs-debuginfo-16.20.2-6.el9_0.x86_64.rpm SHA-256: 7ec298329fd30ba7c5eb7aac847f8123a22bf2ca95557698a3faf01ba60150c5
npm-8.19.4-1.16.20.2.6.el9_0.x86_64.rpm SHA-256: 4c684df92c544296bc2454880230c45cd624081997d8c31999cac52f2037900c

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0

SRPM
nodejs-16.20.2-6.el9_0.src.rpm SHA-256: 0e718036da096ef9d9e0dc11f083d325f0743428f8c03f825d7f5df78b5e8e48
s390x
nodejs-16.20.2-6.el9_0.s390x.rpm SHA-256: 298a89203c69ca83858ea96fc1b7fcc706d0087366b80aafe762716c18c25553
nodejs-debuginfo-16.20.2-6.el9_0.s390x.rpm SHA-256: ce5a1eb265e4d157d0722b474a2064a2619fbe62aec34a383b264c629e5e3d09
nodejs-debugsource-16.20.2-6.el9_0.s390x.rpm SHA-256: ccfd92c753e481ae192b9adb2e5572214ea527473a1a44953825dd95c77cf273
nodejs-docs-16.20.2-6.el9_0.noarch.rpm SHA-256: 36effe5ead946adfa4ba9ada033d7dbfcbd25127b49c049b16d74825ebbe1715
nodejs-full-i18n-16.20.2-6.el9_0.s390x.rpm SHA-256: e13f607d8bfb1ccaec567df1dd5c032e0d4cd0f23d2013e8c33537fc94e6db87
nodejs-libs-16.20.2-6.el9_0.s390x.rpm SHA-256: dacb553f094b9aa3daa95036f103d17db5ee269e1c0651c4d2c337d5534a1ac9
nodejs-libs-debuginfo-16.20.2-6.el9_0.s390x.rpm SHA-256: 928a6823edffa9630cb7f405a58db0966734f55d52be50817676f011f4e5291e
npm-8.19.4-1.16.20.2.6.el9_0.s390x.rpm SHA-256: 76d6982d9d23d71442440f9d0d3cdf33eb1e8f802842258c424c6f89c60b5359

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0

SRPM
nodejs-16.20.2-6.el9_0.src.rpm SHA-256: 0e718036da096ef9d9e0dc11f083d325f0743428f8c03f825d7f5df78b5e8e48
ppc64le
nodejs-16.20.2-6.el9_0.ppc64le.rpm SHA-256: 519ef06efccd193d284d583277f605f55a3de922c0b56d1b9a387f8350cb3395
nodejs-debuginfo-16.20.2-6.el9_0.ppc64le.rpm SHA-256: 940e7dc24def29deb196ad60aafef0b8270077f0c8264e20fc46e8ac0fb07551
nodejs-debugsource-16.20.2-6.el9_0.ppc64le.rpm SHA-256: e878a0070a4e7a6cb330a7592f3266b124f91bee34828da797931b6a8fd9da8f
nodejs-docs-16.20.2-6.el9_0.noarch.rpm SHA-256: 36effe5ead946adfa4ba9ada033d7dbfcbd25127b49c049b16d74825ebbe1715
nodejs-full-i18n-16.20.2-6.el9_0.ppc64le.rpm SHA-256: c4f42995226a4cd83ad642927e1dbd550ce035c8d6c5431cad803562ea74b36a
nodejs-libs-16.20.2-6.el9_0.ppc64le.rpm SHA-256: a4d75303a10c4e1c2807f697e301804c86d4801158cb1ec7b15db4e8a0ec1825
nodejs-libs-debuginfo-16.20.2-6.el9_0.ppc64le.rpm SHA-256: 5b5550dc4d72cf91dba29618ccf4a1e0872ec31e9560f29e2c7087f862b79c59
npm-8.19.4-1.16.20.2.6.el9_0.ppc64le.rpm SHA-256: c0a8e1ef0c07dff572c713352aee4aab5521413f023f535a97fcd13f5a393d25

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0

SRPM
nodejs-16.20.2-6.el9_0.src.rpm SHA-256: 0e718036da096ef9d9e0dc11f083d325f0743428f8c03f825d7f5df78b5e8e48
aarch64
nodejs-16.20.2-6.el9_0.aarch64.rpm SHA-256: cbd3042a915b202cbc5e07e7bd2ac07a3d390767270696a1a1484918b29705aa
nodejs-debuginfo-16.20.2-6.el9_0.aarch64.rpm SHA-256: 0c2753ce1d995515b3f76d95fb01cf1f279ad3e0042dae133fc76fe25a333871
nodejs-debugsource-16.20.2-6.el9_0.aarch64.rpm SHA-256: 71a4d0bcebea9aff0a8f933c27591db1ce0f1d090399137bce6b22e9dd081ef7
nodejs-docs-16.20.2-6.el9_0.noarch.rpm SHA-256: 36effe5ead946adfa4ba9ada033d7dbfcbd25127b49c049b16d74825ebbe1715
nodejs-full-i18n-16.20.2-6.el9_0.aarch64.rpm SHA-256: 2e318bd35dc3382824f2632883aaaaf4e6281ae8d16accdf8d88599505907ece
nodejs-libs-16.20.2-6.el9_0.aarch64.rpm SHA-256: 2b186bd7cdc31bc95cb4b1f5330c3187ef6587e5582c65016a054c6e0314223b
nodejs-libs-debuginfo-16.20.2-6.el9_0.aarch64.rpm SHA-256: 73aa836da24899a85cef1143a6b9c9411c261d366ed079efd1522cb7a92d0f0b
npm-8.19.4-1.16.20.2.6.el9_0.aarch64.rpm SHA-256: 59561f27ec89d3635be39905b41e2a1749fbc46a2f81ad4302e0358d4e064111

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0

SRPM
nodejs-16.20.2-6.el9_0.src.rpm SHA-256: 0e718036da096ef9d9e0dc11f083d325f0743428f8c03f825d7f5df78b5e8e48
ppc64le
nodejs-16.20.2-6.el9_0.ppc64le.rpm SHA-256: 519ef06efccd193d284d583277f605f55a3de922c0b56d1b9a387f8350cb3395
nodejs-debuginfo-16.20.2-6.el9_0.ppc64le.rpm SHA-256: 940e7dc24def29deb196ad60aafef0b8270077f0c8264e20fc46e8ac0fb07551
nodejs-debugsource-16.20.2-6.el9_0.ppc64le.rpm SHA-256: e878a0070a4e7a6cb330a7592f3266b124f91bee34828da797931b6a8fd9da8f
nodejs-docs-16.20.2-6.el9_0.noarch.rpm SHA-256: 36effe5ead946adfa4ba9ada033d7dbfcbd25127b49c049b16d74825ebbe1715
nodejs-full-i18n-16.20.2-6.el9_0.ppc64le.rpm SHA-256: c4f42995226a4cd83ad642927e1dbd550ce035c8d6c5431cad803562ea74b36a
nodejs-libs-16.20.2-6.el9_0.ppc64le.rpm SHA-256: a4d75303a10c4e1c2807f697e301804c86d4801158cb1ec7b15db4e8a0ec1825
nodejs-libs-debuginfo-16.20.2-6.el9_0.ppc64le.rpm SHA-256: 5b5550dc4d72cf91dba29618ccf4a1e0872ec31e9560f29e2c7087f862b79c59
npm-8.19.4-1.16.20.2.6.el9_0.ppc64le.rpm SHA-256: c0a8e1ef0c07dff572c713352aee4aab5521413f023f535a97fcd13f5a393d25

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0

SRPM
nodejs-16.20.2-6.el9_0.src.rpm SHA-256: 0e718036da096ef9d9e0dc11f083d325f0743428f8c03f825d7f5df78b5e8e48
x86_64
nodejs-16.20.2-6.el9_0.x86_64.rpm SHA-256: 90a0125748d20a63973389e9c5b058797011dfd3e045ca45ded316d93403fbd5
nodejs-debuginfo-16.20.2-6.el9_0.i686.rpm SHA-256: 9aaae50bcb8e2bab15e92136bc2a2daabccea50eb9b0f061da45a1ea5dff3181
nodejs-debuginfo-16.20.2-6.el9_0.x86_64.rpm SHA-256: 6602ac2909f08252eac83bc1a8722285920fc66a38744076151a172fbf66cac2
nodejs-debugsource-16.20.2-6.el9_0.i686.rpm SHA-256: 76f263eb51877823cddaed37ff815f97ed86bedd7f7983bd7e2289caa8dfdb03
nodejs-debugsource-16.20.2-6.el9_0.x86_64.rpm SHA-256: fb3e973b27952b0b04c43a1e3ea69259a8549b0d381c3286b40d8eae52c652e9
nodejs-docs-16.20.2-6.el9_0.noarch.rpm SHA-256: 36effe5ead946adfa4ba9ada033d7dbfcbd25127b49c049b16d74825ebbe1715
nodejs-full-i18n-16.20.2-6.el9_0.x86_64.rpm SHA-256: 5d2e2d0590abc334b7b31fda9439014f78c42e0c209131bb6c2983377fa5560e
nodejs-libs-16.20.2-6.el9_0.i686.rpm SHA-256: 15e61e3252a7a75cb1a4195375e057089b14fe7945c80257a8b0f9fb3cf74195
nodejs-libs-16.20.2-6.el9_0.x86_64.rpm SHA-256: ce04719416d2256bc845c38c1c23fce6916a6cee623ddbf844c777c421639885
nodejs-libs-debuginfo-16.20.2-6.el9_0.i686.rpm SHA-256: 44d9f4db03b7137e682d8478f310efb9677c01fb51373e9fdf134a49c817efa5
nodejs-libs-debuginfo-16.20.2-6.el9_0.x86_64.rpm SHA-256: 7ec298329fd30ba7c5eb7aac847f8123a22bf2ca95557698a3faf01ba60150c5
npm-8.19.4-1.16.20.2.6.el9_0.x86_64.rpm SHA-256: 4c684df92c544296bc2454880230c45cd624081997d8c31999cac52f2037900c

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0

SRPM
nodejs-16.20.2-6.el9_0.src.rpm SHA-256: 0e718036da096ef9d9e0dc11f083d325f0743428f8c03f825d7f5df78b5e8e48
aarch64
nodejs-16.20.2-6.el9_0.aarch64.rpm SHA-256: cbd3042a915b202cbc5e07e7bd2ac07a3d390767270696a1a1484918b29705aa
nodejs-debuginfo-16.20.2-6.el9_0.aarch64.rpm SHA-256: 0c2753ce1d995515b3f76d95fb01cf1f279ad3e0042dae133fc76fe25a333871
nodejs-debugsource-16.20.2-6.el9_0.aarch64.rpm SHA-256: 71a4d0bcebea9aff0a8f933c27591db1ce0f1d090399137bce6b22e9dd081ef7
nodejs-docs-16.20.2-6.el9_0.noarch.rpm SHA-256: 36effe5ead946adfa4ba9ada033d7dbfcbd25127b49c049b16d74825ebbe1715
nodejs-full-i18n-16.20.2-6.el9_0.aarch64.rpm SHA-256: 2e318bd35dc3382824f2632883aaaaf4e6281ae8d16accdf8d88599505907ece
nodejs-libs-16.20.2-6.el9_0.aarch64.rpm SHA-256: 2b186bd7cdc31bc95cb4b1f5330c3187ef6587e5582c65016a054c6e0314223b
nodejs-libs-debuginfo-16.20.2-6.el9_0.aarch64.rpm SHA-256: 73aa836da24899a85cef1143a6b9c9411c261d366ed079efd1522cb7a92d0f0b
npm-8.19.4-1.16.20.2.6.el9_0.aarch64.rpm SHA-256: 59561f27ec89d3635be39905b41e2a1749fbc46a2f81ad4302e0358d4e064111

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0

SRPM
nodejs-16.20.2-6.el9_0.src.rpm SHA-256: 0e718036da096ef9d9e0dc11f083d325f0743428f8c03f825d7f5df78b5e8e48
s390x
nodejs-16.20.2-6.el9_0.s390x.rpm SHA-256: 298a89203c69ca83858ea96fc1b7fcc706d0087366b80aafe762716c18c25553
nodejs-debuginfo-16.20.2-6.el9_0.s390x.rpm SHA-256: ce5a1eb265e4d157d0722b474a2064a2619fbe62aec34a383b264c629e5e3d09
nodejs-debugsource-16.20.2-6.el9_0.s390x.rpm SHA-256: ccfd92c753e481ae192b9adb2e5572214ea527473a1a44953825dd95c77cf273
nodejs-docs-16.20.2-6.el9_0.noarch.rpm SHA-256: 36effe5ead946adfa4ba9ada033d7dbfcbd25127b49c049b16d74825ebbe1715
nodejs-full-i18n-16.20.2-6.el9_0.s390x.rpm SHA-256: e13f607d8bfb1ccaec567df1dd5c032e0d4cd0f23d2013e8c33537fc94e6db87
nodejs-libs-16.20.2-6.el9_0.s390x.rpm SHA-256: dacb553f094b9aa3daa95036f103d17db5ee269e1c0651c4d2c337d5534a1ac9
nodejs-libs-debuginfo-16.20.2-6.el9_0.s390x.rpm SHA-256: 928a6823edffa9630cb7f405a58db0966734f55d52be50817676f011f4e5291e
npm-8.19.4-1.16.20.2.6.el9_0.s390x.rpm SHA-256: 76d6982d9d23d71442440f9d0d3cdf33eb1e8f802842258c424c6f89c60b5359

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.