MGASA-2023-0078 - Updated nodejs packages fix security vulnerability

Publication date: 01 Mar 2023
URL: https://advisories.mageia.org/MGASA-2023-0078.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2023-23918,
     CVE-2023-23920

The following CVEs are fixed in this release:

CVE-2023-23918: Node.js Permissions policies can be bypassed via
process.mainModule (High)
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA
environment variable (Low)
More detailed information on each of the vulnerabilities can be found in
February 2023 Security Releases blog post.

This security release includes OpenSSL security updates as outlined in the
recent OpenSSL security advisory.

This security release also includes an npm update for Node.js 14 to
address a number of CVEs which either do not affect Node.js or are low
severity in the context of Node.js. You can get more details for the
individual CVEs in nodejs-dependency-vuln-assessments.

References:
- https://bugs.mageia.org/show_bug.cgi?id=31559
- https://github.com/nodejs/node/releases/tag/v14.21.3
- https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
- https://www.openssl.org/news/secadv/20230207.txt
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920

SRPMS:
- 8/core/nodejs-14.21.3-2.1.mga8