Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 6 articles for you...
197
security advisorysecurity issuedebianDebian 10: DLA-3344-1 Critical Node.js DNS Rebinding Threat
Vulnerabilities have been found in Node.js, which could result in DNS rebinding or arbitrary code execution. CVE-2022-43548 . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3344-1
Feb 26, 2023
•Critical
Debian LTS
100
security advisoryhigh severitysoftware patchSUSE: 2022:4255-1 Important: Nodejs14 DNS Rebinding Fix
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4255-1 Rating: important References: #1205119 Cross-References: CVE-2022-43548 CVSS scores: CVE-2022-43548 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Web Scripting 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nodejs14 fixes the following issues: - Update to 14.21.1: - CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119). - Update to 14.21.0: - src: add --openssl-shared-config option Patch Instructions: To install this SUSE Security Update use the SUSE recommendedinstallation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4255=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4255=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4255=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4255=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4255=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4255=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4255=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-4255=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2022-4255=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-4255=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-4255=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-4255=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): corepack14-14.21.1-150200.15.40.2 nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - openSUSE Leap 15.4 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - openSUSE Leap 15.3 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Manager Server 4.1 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Manager Retail Branch Server 4.1 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Manager Retail Branch Server 4.1 (x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Manager Proxy 4.1 (x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Manager Proxy 4.1 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server 15-SP2-LTSS(noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Enterprise Storage 7 (aarch64 x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Enterprise Storage 7 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 References: https://www.suse.com/security/cve/CVE-2022-43548.html https://bugzilla.suse.com/1205119 . Crucial SUSE Security Patch for nodejs addressing CVE-2022-43548 to enhance system robustness and integrity.. Nodejs Security Update, SUSE Linux Update, DNS Rebinding Fix. . Severity: Important. LinuxSecurity.com Team
Nov 28, 2022
•Important
SuSE
100
security advisorysoftware updatepatchSUSE: 2022:4084-1 Important: DNS Rebinding Fix for Nodejs16
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for nodejs16 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4084-1 Rating: important References: #1205119 Cross-References: CVE-2022-43548 CVSS scores: CVE-2022-43548 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Web Scripting 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nodejs16 fixes the following issues: - Update to LTS versino 16.18.1. - CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119). - Update to LTS version 16.18.0: * http: throw error on content-length mismatch * stream: add ReadableByteStream.tee() * deps: npm updated to 8.19.2 Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4084=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2022-4084=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs16-16.18.1-150300.7.15.1 nodejs16-debuginfo-16.18.1-150300.7.15.1 nodejs16-debugsource-16.18.1-150300.7.15.1 nodejs16-devel-16.18.1-150300.7.15.1 npm16-16.18.1-150300.7.15.1 - openSUSE Leap 15.3 (noarch): nodejs16-docs-16.18.1-150300.7.15.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64): nodejs16-16.18.1-150300.7.15.1 nodejs16-debuginfo-16.18.1-150300.7.15.1 nodejs16-debugsource-16.18.1-150300.7.15.1 nodejs16-devel-16.18.1-150300.7.15.1 npm16-16.18.1-150300.7.15.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (noarch): nodejs16-docs-16.18.1-150300.7.15.1 References: https://www.suse.com/security/cve/CVE-2022-43548.html https://bugzilla.suse.com/1205119 . Update addressing a DNS rebinding flaw in nodejs16 for various SUSE distributions. Important security advisory.. SUSE Nodejs Security Patch, DNS Rebinding Fix, Important Software Update. . Severity: Important. LinuxSecurity.com Team
Nov 18, 2022
•Important
SuSE
100
security advisorypatchimportantSUSE: 2022:2551-1 Important: nodejs16 Security Update for High Risks
An update that solves four vulnerabilities and has one errata is now available. . SUSE Security Update: Security update for nodejs16 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2551-1 Rating: important References: #1192489 #1201325 #1201326 #1201327 #1201328 Cross-References: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215 CVSS scores: CVE-2022-32212 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-32212 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-32213 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-32213 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2022-32214 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-32214 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2022-32215 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-32215 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Web Scripting 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for nodejs16 fixes the following issues: - CVE-2022-32212: Fixed DNS rebinding in--inspect via invalid IP addresses (bsc#1201328). - CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding (bsc#1201325). - CVE-2022-32214: Fixed HTTP request smuggling due to improper delimiting of header fields (bsc#1201326). - CVE-2022-32215: Fixed HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (bsc#1201327). The following non-security bug was fixed: - Add buildtime version check to determine if we need patched openssl Requires: or already in upstream. (bsc#1192489) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2551=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2022-2551=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs16-16.16.0-150300.7.6.2 nodejs16-debuginfo-16.16.0-150300.7.6.2 nodejs16-debugsource-16.16.0-150300.7.6.2 nodejs16-devel-16.16.0-150300.7.6.2 npm16-16.16.0-150300.7.6.2 - openSUSE Leap 15.3 (noarch): nodejs16-docs-16.16.0-150300.7.6.2 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64): nodejs16-16.16.0-150300.7.6.2 nodejs16-debuginfo-16.16.0-150300.7.6.2 nodejs16-debugsource-16.16.0-150300.7.6.2 nodejs16-devel-16.16.0-150300.7.6.2 npm16-16.16.0-150300.7.6.2 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (noarch): nodejs16-docs-16.16.0-150300.7.6.2 References: https://www.suse.com/security/cve/CVE-2022-32212.html https://www.suse.com/security/cve/CVE-2022-32213.html https://www.suse.com/security/cve/CVE-2022-32214.html https://www.suse.com/security/cve/CVE-2022-32215.html https://bugzilla.suse.com/1192489 https://bugzilla.suse.com/1201325 https://bugzilla.suse.com/1201326 https://bugzilla.suse.com/1201327 https://bugzilla.suse.com/1201328 . An important Debian Security Patch for python3 addresses significant concerns and resolves multiple security flaws.. nodejs16 Security Update, SUSE Patch, HTTP Request Fix. . Severity: Important. LinuxSecurity.com Team
Jul 26, 2022
•Important
SuSE
197
security advisorydebianremote accessDebian 9 Stretch: DLA-2973-1 Moderate: Minidlna DNS Rebinding Fix
An issue has been found in minidlna, a lightweight DLNA/UPnP-AV server targeted at embedded systems. HTTP requests needed more checks to protect against DNS rebinding, thus forbid a remote web server to exfiltrate . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2973-1
Apr 09, 2022
Debian LTS
100
security advisoryupdatecriticalSUSE: 2021:2080-1 Critical Security Advisory for gupnp DNS Flaw
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for gupnp ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:2080-1 Rating: important References: #1186590 Cross-References: CVE-2021-33516 CVSS scores: CVE-2021-33516 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2021-33516 (SUSE): 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP5 SUSE Linux Enterprise Software Development Kit 12-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gupnp fixes the following issues: - CVE-2021-33516: Fixed a DNS rebinding, which could trick the browser into triggering actions against local UPnP services (bsc#1186590). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP5: zypper in -t patch SUSE-SLE-WE-12-SP5-2021-2080=1 - SUSE Linux Enterprise Software Development Kit 12-SP5: zypper in -t patch SUSE-SLE-SDK-12-SP5-2021-2080=1 Package List: - SUSE Linux Enterprise Workstation Extension 12-SP5 (x86_64): gupnp-debugsource-0.20.18-8.3.1 libgupnp-1_0-4-0.20.18-8.3.1 libgupnp-1_0-4-debuginfo-0.20.18-8.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le s390x x86_64): gupnp-debugsource-0.20.18-8.3.1 libgupnp-1_0-4-0.20.18-8.3.1 libgupnp-1_0-4-debuginfo-0.20.18-8.3.1 libgupnp-devel-0.20.18-8.3.1 typelib-1_0-GUPnP-1_0-0.20.18-8.3.1 References: https://www.suse.com/security/cve/CVE-2021-33516.html https://bugzilla.suse.com/1186590 . A recent SUSE Security Update resolves a significant DNS rebinding vulnerability in gupnp. This advisory emphasizes the importance of maintaining system integrity.. SUSE Updates, gupnp Security, DNS Rebinding Fix, Security Advisory. . Severity: Critical. LinuxSecurity.com Team
Jun 18, 2021
•Critical
SuSE
200
security advisoryimportant updatebrowser exploitScientific Linux 7 SLSA-2021:2417-1 Important GUPnP DNS Rebinding Fix
gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services (CVE-2021-33516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE --- SL7 x86_64 gupnp-1.0.2-6.el7_9.i686.rpm gupnp-1.0.2-6.el7_9.x86_64.rpm gupnp-debuginfo-1.0.2-6.el7_ [More...]. Synopsis: Important: gupnp security update Advisory ID: SLSA-2021:2417-1 Issue Date: 2021-06-15 CVE Numbers: CVE-2021-33516 -- Security Fix(es): * gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services (CVE-2021-33516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE --- SL7 x86_64 gupnp-1.0.2-6.el7_9.i686.rpm gupnp-1.0.2-6.el7_9.x86_64.rpm gupnp-debuginfo-1.0.2-6.el7_9.i686.rpm gupnp-debuginfo-1.0.2-6.el7_9.x86_64.rpm gupnp-devel-1.0.2-6.el7_9.i686.rpm gupnp-devel-1.0.2-6.el7_9.x86_64.rpm noarch gupnp-docs-1.0.2-6.el7_9.noarch.rpm -- - Scientific Linux Development Team . A critical GUPnP security flaw exposes SL7 x86_64 systems to DNS rebinding attacks. Immediate patching is essential to protect sensitive information and network integrity. Gupnp Security Advisory, Important Update Gupnp, DNS Rebinding SL7, Browser Exploit Presentation, Scientific Linux Security. . Severity: Important. LinuxSecurity.com Team
Jun 15, 2021
•Important
Scientific Linux
98
security advisorydenial of serviceRed HatRed Hat: RHSA-2021:0831-01 Important: DoS and DNS Rebinding Issues
An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: rh-nodejs12-nodejs security update Advisory ID: RHSA-2021:0831-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2021:0831 Issue date: 2021-03-15 CVE Names: CVE-2021-22883 CVE-2021-22884 ==================================================================== 1. Summary: An update for rh-nodejs12-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.21.0). Security Fix(es): * nodejs: HTTP2 'unknownProtocol' cause DoS by resource exhaustion (CVE-2021-22883) * nodejs: DNS rebinding in --inspect (CVE-2021-22884) For more details about the securityissue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1932014 - CVE-2021-22883 nodejs: HTTP2 'unknownProtocol' cause DoS by resource exhaustion 1932024 - CVE-2021-22884 nodejs: DNS rebinding in --inspect 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-nodejs12-nodejs-12.21.0-1.el7.src.rpm noarch: rh-nodejs12-nodejs-docs-12.21.0-1.el7.noarch.rpm ppc64le: rh-nodejs12-nodejs-12.21.0-1.el7.ppc64le.rpm rh-nodejs12-nodejs-debuginfo-12.21.0-1.el7.ppc64le.rpm rh-nodejs12-nodejs-devel-12.21.0-1.el7.ppc64le.rpm rh-nodejs12-npm-6.14.11-12.21.0.1.el7.ppc64le.rpm s390x: rh-nodejs12-nodejs-12.21.0-1.el7.s390x.rpm rh-nodejs12-nodejs-debuginfo-12.21.0-1.el7.s390x.rpm rh-nodejs12-nodejs-devel-12.21.0-1.el7.s390x.rpm rh-nodejs12-npm-6.14.11-12.21.0.1.el7.s390x.rpm x86_64: rh-nodejs12-nodejs-12.21.0-1.el7.x86_64.rpm rh-nodejs12-nodejs-debuginfo-12.21.0-1.el7.x86_64.rpm rh-nodejs12-nodejs-devel-12.21.0-1.el7.x86_64.rpm rh-nodejs12-npm-6.14.11-12.21.0.1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v.7.6): Source: rh-nodejs12-nodejs-12.21.0-1.el7.src.rpm noarch: rh-nodejs12-nodejs-docs-12.21.0-1.el7.noarch.rpm ppc64le: rh-nodejs12-nodejs-12.21.0-1.el7.ppc64le.rpm rh-nodejs12-nodejs-debuginfo-12.21.0-1.el7.ppc64le.rpm rh-nodejs12-nodejs-devel-12.21.0-1.el7.ppc64le.rpm rh-nodejs12-npm-6.14.11-12.21.0.1.el7.ppc64le.rpm s390x: rh-nodejs12-nodejs-12.21.0-1.el7.s390x.rpm rh-nodejs12-nodejs-debuginfo-12.21.0-1.el7.s390x.rpm rh-nodejs12-nodejs-devel-12.21.0-1.el7.s390x.rpm rh-nodejs12-npm-6.14.11-12.21.0.1.el7.s390x.rpm x86_64: rh-nodejs12-nodejs-12.21.0-1.el7.x86_64.rpm rh-nodejs12-nodejs-debuginfo-12.21.0-1.el7.x86_64.rpm rh-nodejs12-nodejs-devel-12.21.0-1.el7.x86_64.rpm rh-nodejs12-npm-6.14.11-12.21.0.1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7): Source: rh-nodejs12-nodejs-12.21.0-1.el7.src.rpm noarch: rh-nodejs12-nodejs-docs-12.21.0-1.el7.noarch.rpm ppc64le: rh-nodejs12-nodejs-12.21.0-1.el7.ppc64le.rpm rh-nodejs12-nodejs-debuginfo-12.21.0-1.el7.ppc64le.rpm rh-nodejs12-nodejs-devel-12.21.0-1.el7.ppc64le.rpm rh-nodejs12-npm-6.14.11-12.21.0.1.el7.ppc64le.rpm s390x: rh-nodejs12-nodejs-12.21.0-1.el7.s390x.rpm rh-nodejs12-nodejs-debuginfo-12.21.0-1.el7.s390x.rpm rh-nodejs12-nodejs-devel-12.21.0-1.el7.s390x.rpm rh-nodejs12-npm-6.14.11-12.21.0.1.el7.s390x.rpm x86_64: rh-nodejs12-nodejs-12.21.0-1.el7.x86_64.rpm rh-nodejs12-nodejs-debuginfo-12.21.0-1.el7.x86_64.rpm rh-nodejs12-nodejs-devel-12.21.0-1.el7.x86_64.rpm rh-nodejs12-npm-6.14.11-12.21.0.1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-nodejs12-nodejs-12.21.0-1.el7.src.rpm noarch: rh-nodejs12-nodejs-docs-12.21.0-1.el7.noarch.rpm x86_64: rh-nodejs12-nodejs-12.21.0-1.el7.x86_64.rpm rh-nodejs12-nodejs-debuginfo-12.21.0-1.el7.x86_64.rpm rh-nodejs12-nodejs-devel-12.21.0-1.el7.x86_64.rpm rh-nodejs12-npm-6.14.11-12.21.0.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature areavailable from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2021-22883 https://access.redhat.com/security/cve/CVE-2021-22884 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYE92CtzjgjWX9erEAQi7zA//cdaRz0yRNOMdeC+CXrPPTG9QZ9l0BtSc oNcDiz6/FfJ91wL9GTw5K0UfRw8Fv6aut8I98GrxqGtCwlTxsTxF+mqzzEkrKYD6 F1BrXzZPLRAZAmoLZ/a65cMLQ/DsKbbgAfEoYtqZt1vKkEEqwP6MswYUyMkOE3eQ TKtX2U5cEFVroAN+harESQcNnS0fTtjVD1IoflSSnWGmdyCJP7PN9RwY+K0qStky n7KQQ0C+FtjPf9sdkl7OpmCs8NLfbgaNsPDT+ngJG7SSsOPww0UsWDNnn+CQG0dc c558pZNC0wtwgPprr1rheHrxRuEWFSwL9yEEhOU2DIbYwcXhzCR3GLupgwHFFnZ0 kb58YBd/6S3HD8BAfIa2guwvdhLTW6zw9ne//7ypFFCaPpJRFnxHHj3A7mwfm4Ux 9Z2tZ8/FsJj3IeYg459a4v1fEpw17GZpuoqInYa6LFfjZhAVCJGSpU1F/Ern+vYR bL5chyL8vtYQL9gHV+5NwIEdAhCJkv/tzwFd9MkzDBGaEHxWhFEVrps5HBBVqxYj Vcig90uroSG8Jf30oiuBSxzkx6HlPQ53Lzj2hh7JxSo0etSA1HmDfQ/+1TVu8Ows fjQu4gmcC6nFyCPPXggj0Be2rKTkRHNBDmlVwxMCrRS+vkEJkScF//9++Y8beEQb 7unjXPZY1Gs=QDQw -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Mar 15, 2021
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!