Stay Secure with the Latest Linux Advisories

security advisorysecurity updatecritical

Mageia: 2023-0079 Urgent: Ruby on Rails Session Fixation and File Handling

The following CVEs are fixed in this release: CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA . MGASA-2023-0078 - Updated nodejs packages fix security vulnerability Publication date: 01 Mar 2023 URL: https://advisories.mageia.org/MGASA-2023-0078.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-23918, CVE-2023-23920 The following CVEs are fixed in this release: CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post. This security release includes OpenSSL security updates as outlined in the recent OpenSSL security advisory. This security release also includes an npm update for Node.js 14 to address a number of CVEs which either do not affect Node.js or are low severity in the context of Node.js. You can get more details for the individual CVEs in nodejs-dependency-vuln-assessments. References: - https://bugs.mageia.org/show_bug.cgi?id=31559 - https://github.com/nodejs/node/releases/tag/v14.21.3 - https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/ - https://openssl-library.org/news/secadv/20230207.txt - https://www.cve.org/CVERecord?id=CVE-2023-23918 - https://www.cve.org/CVERecord?id=CVE-2023-23920 SRPMS: - 8/core/nodejs-14.21.3-2.1.mga8 . Patch released for Node.js to handle severe flaws concerning access rights and confidential data integrity in Mageia distributions.. Node.js Security, Mageia Security Update, Permissions Bypass, ICU Data Security. . Severity: Important. LinuxSecurity.com Team

Mar 01, 2023 •Important Mageia