Mageia: 2023-0079 Urgent: Ruby on Rails Session Fixation and File Handling
mageia
March 1, 2023
The following CVEs are fixed in this release: CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920: Node.js insecure loading o...
Summary
The following CVEs are fixed in this release:
CVE-2023-23918: Node.js Permissions policies can be bypassed via
process.mainModule (High)
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA
environment variable (Low)
More detailed information on each of the vulnerabilities can be found in
February 2023 Security Releases blog post.
This security release includes OpenSSL security updates as outlined in the
recent OpenSSL security advisory.
This security release also includes an npm update for Node.js 14 to
address a number of CVEs which either do not affect Node.js or are low
severity in the context of Node.js. You can get more details for the
individual CVEs in nodejs-dependency-vuln-assessments.
References
- https://bugs.mageia.org/show_bug.cgi?id=31559
- https://github.com/nodejs/node/releases/tag/v14.21.3
- https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
- https://openssl-library.org/news/secadv/20230207.txt
- https://www.cve.org/CVERecord?id=CVE-2023-23918
- https://www.cve.org/CVERecord?id=CVE-2023-23920
Resolution
SRPMS
- 8/core/nodejs-14.21.3-2.1.mga8
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Publication date: 01 Mar 2023
URL: https://advisories.mageia.org/MGASA-2023-0078.html
Type: security
CVE: CVE-2023-23918,
CVE-2023-23920
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!