Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
219
security advisorysoftware updatebug fixRocky Linux 9 RLSA-2023:5532 Important Nodejs Security Fixes
Important: nodejs security and bug fix update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2023:5532", "synopsis": "Important: nodejs security and bug fix update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for nodejs.\nThis update affects Rocky Linux 9.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)\n\n* nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006)\n\n* nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs: Rebase to the latest Nodejs 16 release [rhel-9] (BZ#2236434)", "solution": null, "affectedProducts": ["Rocky Linux 9"], "fixes": [{"ticket": "2230948", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2230948", "description": ""}, {"ticket": "2230955", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2230955", "description": ""}, {"ticket": "2230956", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2230956", "description": ""}, {"ticket": "2236434", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2236434", "description": "* nodejs: Rebase to the latest Nodejs 16 release [rhel-9]"}], "cves": [{"name": "CVE-2023-32002", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-32002", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN","cwe": "UNKNOWN"}, {"name": "CVE-2023-32006", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-32006", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}, {"name": "CVE-2023-32559", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-32559", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}], "references": [], "publishedAt": "2023-10-14T02:08:35.099316Z", "rpms": {"Rocky Linux 9": {"nvras": ["nodejs-1:16.20.2-1.el9_2.aarch64.rpm", "nodejs-1:16.20.2-1.el9_2.src.rpm", "nodejs-debuginfo-1:16.20.2-1.el9_2.aarch64.rpm", "nodejs-debugsource-1:16.20.2-1.el9_2.aarch64.rpm", "nodejs-docs-1:16.20.2-1.el9_2.noarch.rpm", "nodejs-full-i18n-1:16.20.2-1.el9_2.aarch64.rpm", "nodejs-libs-1:16.20.2-1.el9_2.aarch64.rpm", "nodejs-libs-debuginfo-1:16.20.2-1.el9_2.aarch64.rpm", "npm-1:8.19.4-1.16.20.2.1.el9_2.aarch64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. A security and bug fix release for Node.js has now arrived for Rocky Linux 9. This update addresses potential vulnerabilities related to permission settings.. Rocky Linux Security, Nodejs Updates, Bug Fixes, Permissions Policies. . Severity: Important. LinuxSecurity.com Team
Oct 14, 2023
•Important
Rocky Linux
98
security advisoryRed Hatbug fixRedHat 9 RHSA-2023-5363-01 Important: Node.js 18 Security Issues
An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: nodejs:18 security, bug fix, and enhancement update Advisory ID: RHSA-2023:5363-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:5363 Issue date: 2023-09-26 CVE Names: CVE-2022-25883 CVE-2023-32002 CVE-2023-32006 CVE-2023-32559 ===================================================================== 1. Summary: An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2223313, BZ#2234404) Security Fix(es): * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002) * nodejs-semver: Regular expression denial of service (CVE-2022-25883) * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006) * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559) For more details about the security issue(s), including the impact, a CVSS score,acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2216475 - CVE-2022-25883 nodejs-semver: Regular expression denial of service 2223313 - nodejs:18/nodejs: Rebase to the latest Nodejs 18 release [rhel-9] [rhel-9.2.0.z] 2230948 - CVE-2023-32002 nodejs: Permissions policies can be bypassed via Module._load 2230955 - CVE-2023-32006 nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() 2230956 - CVE-2023-32559 nodejs: Permissions policies can be bypassed via process.binding 2234404 - nodejs:18/nodejs: Rebase to the latest Nodejs 18 release [rhel-9] [rhel-9.2.0.z] 6. Package List: Red Hat Enterprise Linux AppStream (v.9): Source: nodejs-18.17.1-1.module+el9.2.0.z+19753+58118bc0.src.rpm nodejs-nodemon-3.0.1-1.module+el9.2.0.z+19753+58118bc0.src.rpm nodejs-packaging-2021.06-4.module+el9.1.0+15718+e52ec601.src.rpm aarch64: nodejs-18.17.1-1.module+el9.2.0.z+19753+58118bc0.aarch64.rpm nodejs-debuginfo-18.17.1-1.module+el9.2.0.z+19753+58118bc0.aarch64.rpm nodejs-debugsource-18.17.1-1.module+el9.2.0.z+19753+58118bc0.aarch64.rpm nodejs-devel-18.17.1-1.module+el9.2.0.z+19753+58118bc0.aarch64.rpm nodejs-full-i18n-18.17.1-1.module+el9.2.0.z+19753+58118bc0.aarch64.rpm npm-9.6.7-1.18.17.1.1.module+el9.2.0.z+19753+58118bc0.aarch64.rpm noarch: nodejs-docs-18.17.1-1.module+el9.2.0.z+19753+58118bc0.noarch.rpm nodejs-nodemon-3.0.1-1.module+el9.2.0.z+19753+58118bc0.noarch.rpm nodejs-packaging-2021.06-4.module+el9.1.0+15718+e52ec601.noarch.rpm nodejs-packaging-bundler-2021.06-4.module+el9.1.0+15718+e52ec601.noarch.rpm ppc64le: nodejs-18.17.1-1.module+el9.2.0.z+19753+58118bc0.ppc64le.rpm nodejs-debuginfo-18.17.1-1.module+el9.2.0.z+19753+58118bc0.ppc64le.rpm nodejs-debugsource-18.17.1-1.module+el9.2.0.z+19753+58118bc0.ppc64le.rpm nodejs-devel-18.17.1-1.module+el9.2.0.z+19753+58118bc0.ppc64le.rpm nodejs-full-i18n-18.17.1-1.module+el9.2.0.z+19753+58118bc0.ppc64le.rpm npm-9.6.7-1.18.17.1.1.module+el9.2.0.z+19753+58118bc0.ppc64le.rpm s390x: nodejs-18.17.1-1.module+el9.2.0.z+19753+58118bc0.s390x.rpm nodejs-debuginfo-18.17.1-1.module+el9.2.0.z+19753+58118bc0.s390x.rpm nodejs-debugsource-18.17.1-1.module+el9.2.0.z+19753+58118bc0.s390x.rpm nodejs-devel-18.17.1-1.module+el9.2.0.z+19753+58118bc0.s390x.rpm nodejs-full-i18n-18.17.1-1.module+el9.2.0.z+19753+58118bc0.s390x.rpm npm-9.6.7-1.18.17.1.1.module+el9.2.0.z+19753+58118bc0.s390x.rpm x86_64: nodejs-18.17.1-1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm nodejs-debuginfo-18.17.1-1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm nodejs-debugsource-18.17.1-1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm nodejs-devel-18.17.1-1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm nodejs-full-i18n-18.17.1-1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm npm-9.6.7-1.18.17.1.1.module+el9.2.0.z+19753+58118bc0.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-25883 https://access.redhat.com/security/cve/CVE-2023-32002 https://access.redhat.com/security/cve/CVE-2023-32006 https://access.redhat.com/security/cve/CVE-2023-32559 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJlEvhJAAoJENzjgjWX9erEo5YQAJrAJckYpC4Ba1rhDGGQ46/P 3lbT2QoOiy7SGCGgplFmyH5PTYmS3WLfxFbvjLniRHMODBxBHG23nCDdBKNQGK6x tS+jPaDt9fX3Gl2Q/oIccTk+h8zkUQBwYv23fRh/bpagEtrcTWoMkRfeVWT52gs0 gjfu2Ez+i+06OufKgAvYYoSKpGcq9QDQ1UGGqR14AuID2wlmJ5bJ0TtfhWnVHoOq cHHGhLCtzasmk+k8Gi4zYfp3dAyUKA7253rxyH73dr6BQr7sgcO0SNW31Ur3Gjwp dGLsA4ydgu7NnoRl5R6zjlmPKkgUawZ4aV9LvAePa5hu86rbcHwt/uAwtu3OgHs+ 6Hn7zUEbXCF1BXtAVUkmmEWTEiMZ9+2B7JvzbkxambM0lr6RMctJ+irh1429k2wr RlXmFSN2jZUP7wZGSlG7+U6vXI0JW64FlE0oWmKsaxvAtaPTbDU8nA+VejOhplDe Nx1jeGb6cJLplG/d3nsGDGrYSrkG1IXzBVKBvfW4qBdicOHNO6Xy32CVH1PmD6V4 VX4C5+PKl0OyzIYxXSlIGbn02cZg1J3tW0cbdKOK3lsRD4cbQVNl2234M+aFFRKk j8D+NiHmbMpXDSHHP6S1T3xpWeJ6Wl9TRCrcYPPbJNQXS8x4okGAnunOUqSqJNsf 1+N9c9dYtcCCjI1NnmHA =1q20 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 26, 2023
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!