access.redhat.com Open in urlscan Pro
2a02:26f0:3500:18::1724:a291 Public Scan

Back to summary

URL:
https://access.redhat.com/errata/RHSA-2023:1743
Submission: On April 21 via api (April 21st 2023, 3:53:49 pm UTC) from BE — Scanned from DE

Form analysis
1 forms found in the DOM

Name: topSearchForm — GET /search/browse/search/

<form class="ng-pristine ng-valid topSearchForm" id="topSearchForm" name="topSearchForm" action="/search/browse/search/" method="get" enctype="application/x-www-form-urlencoded">
  <cp-search-autocomplete class="push-bottom PFElement" path="/webassets/avalon/j/data.json" num-items="5" placeholder="Enter your search term" pfelement="" type="container"></cp-search-autocomplete>
  <div>Or <a href="/support/cases/#/troubleshoot">troubleshoot an issue</a>. </div>
</form>

Text Content

Note: Our personalized web services require that your browser be enabled for
JavaScript and cookies
Skip to navigation Skip to main content


UTILITIES

 * Subscriptions
 * Downloads
 * Containers
 * Support Cases


 * Subscriptions
 * Downloads
 * Containers
 * Support Cases
 * Products & Services
   
   
   PRODUCTS
   
   
   SUPPORT
   
    * Production Support
    * Development Support
    * Product Life Cycles
   
   
   SERVICES
   
    * Consulting
    * Technical Account Management
    * Training & Certifications
   
   
   DOCUMENTATION
   
    * Red Hat Enterprise Linux
    * Red Hat JBoss Enterprise Application Platform
    * Red Hat OpenStack Platform
    * Red Hat OpenShift Container Platform
   
   All Documentation
   
   
   ECOSYSTEM CATALOG
   
    * Red Hat Partner Ecosystem
    * Partner Resources

 * Tools
   
   
   TOOLS
   
    * Troubleshoot a product issue
    * Packages
    * Errata
   
   
   CUSTOMER PORTAL LABS
   
    * Configuration
    * Deployment
    * Security
    * Troubleshoot
   
   All labs
   
   RED HAT INSIGHTS
   
   Increase visibility into IT operations to detect and resolve technical issues
   before they impact your business.
   
   Learn More
   Go to Insights
 * Security
   
   
   RED HAT PRODUCT SECURITY CENTER
   
   Engage with our Red Hat Product Security team, access security updates, and
   ensure your environments are not exposed to any known security
   vulnerabilities.
   
   Product Security Center
   
   
   SECURITY UPDATES
   
    * Security Advisories
    * Red Hat CVE Database
    * Security Labs
   
   Keep your systems secure with Red Hat's specialized responses to security
   vulnerabilities.
   
   View Responses
   
   
   RESOURCES
   
    * Security Blog
    * Security Measurement
    * Severity Ratings
    * Backporting Policies
    * Product Signing (GPG) Keys

 * Community
   
   
   CUSTOMER PORTAL COMMUNITY
   
    * Discussions
    * Private Groups
   
   Community Activity
   
   
   CUSTOMER EVENTS
   
    * Red Hat Convergence
    * Red Hat Summit
   
   
   STORIES
   
    * Red Hat Subscription Value
    * You Asked. We Acted.
    * Open Source Communities

Or troubleshoot an issue.
English


SELECT YOUR LANGUAGE

 * English
 * 한국어
 * 日本語
 * 中文 (中国)

Infrastructure and Management
 * Red Hat Enterprise Linux
 * Red Hat Virtualization
 * Red Hat Identity Management
 * Red Hat Directory Server
 * Red Hat Certificate System
 * Red Hat Satellite
 * Red Hat Subscription Management
 * Red Hat Update Infrastructure
 * Red Hat Insights
 * Red Hat Ansible Automation Platform

Cloud Computing
 * Red Hat OpenShift
 * Red Hat CloudForms
 * Red Hat OpenStack Platform
 * Red Hat OpenShift Container Platform
 * Red Hat OpenShift Data Science
 * Red Hat OpenShift Online
 * Red Hat OpenShift Dedicated
 * Red Hat Advanced Cluster Security for Kubernetes
 * Red Hat Advanced Cluster Management for Kubernetes
 * Red Hat Quay
 * OpenShift Dev Spaces
 * Red Hat OpenShift Service on AWS

Storage
 * Red Hat Gluster Storage
 * Red Hat Hyperconverged Infrastructure
 * Red Hat Ceph Storage
 * Red Hat OpenShift Data Foundation

Runtimes
 * Red Hat Runtimes
 * Red Hat JBoss Enterprise Application Platform
 * Red Hat Data Grid
 * Red Hat JBoss Web Server
 * Red Hat Single Sign On
 * Red Hat support for Spring Boot
 * Red Hat build of Node.js
 * Red Hat build of Thorntail
 * Red Hat build of Eclipse Vert.x
 * Red Hat build of OpenJDK
 * Red Hat build of Quarkus

Integration and Automation
 * Red Hat Integration
 * Red Hat Fuse
 * Red Hat AMQ
 * Red Hat 3scale API Management
 * Red Hat JBoss Data Virtualization

 * Red Hat Process Automation
 * Red Hat Process Automation Manager
 * Red Hat Decision Manager

All Products
All Red Hat
Back to menu

 * You are here
   
   
   
   
   RED HAT
   
   Learn about our open source products, services, and company.

 * You are here
   
   
   
   
   RED HAT CUSTOMER PORTAL
   
   Get product support and knowledge from the open source experts.

 * You are here
   
   
   
   
   RED HAT DEVELOPER
   
   Read developer tutorials and download Red Hat software for cloud application
   development.

 * You are here
   
   
   
   
   RED HAT PARTNER CONNECT
   
   Become a Red Hat partner and get support in building customer solutions.

--------------------------------------------------------------------------------


 * PRODUCTS
   
   
   * ANSIBLE.COM
     
     Learn about and try our IT automation product.


 * TRY, BUY, SELL
   
   
   * RED HAT HYBRID CLOUD
     
     Access technical how-tos, tutorials, and learning paths focused on Red
     Hat’s hybrid cloud managed services.
   
   
   * RED HAT STORE
     
     Buy select Red Hat products and services online.
   
   
   * RED HAT MARKETPLACE
     
     Try, buy, sell, and manage certified enterprise software for
     container-based environments.


 * COMMUNITY & OPEN SOURCE
   
   
   * THE ENTERPRISERS PROJECT
     
     Read analysis and advice articles written by CIOs, for CIOs.
   
   
   * OPENSOURCE.COM
     
     Read articles on a range of topics about open source.


 *  
   
   
   * RED HAT SUMMIT
     
     Register for and learn about our annual open source IT industry event.
   
   
   * RED HAT ECOSYSTEM CATALOG
     
     Find hardware, software, and cloud providers―and download container
     images―certified to perform with Red Hat technologies.



Red Hat Product Errata RHSA-2023:1743 - Security Advisory
Issued: 2023-04-12 Updated: 2023-04-12


RHSA-2023:1743 - SECURITY ADVISORY

 * Overview
 * Updated Packages


SYNOPSIS

Important: nodejs:14 security, bug fix, and enhancement update


TYPE/SEVERITY

Security Advisory: Important


RED HAT INSIGHTS PATCH ANALYSIS

Identify and remediate systems affected by this advisory.

View affected systems


TOPIC

An update for the nodejs:14 module is now available for Red Hat Enterprise Linux
8.


Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.


DESCRIPTION

Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.


The following packages have been upgraded to a later upstream version: nodejs
(14.21.3).


Security Fix(es):


 * decode-uri-component: improper input validation resulting in DoS
   (CVE-2022-38900)
 * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
 * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
 * c-ares: buffer overflow in config_sortlist() due to missing string length
   check (CVE-2022-4904)
 * http-cache-semantics: Regular Expression Denial of Service (ReDoS)
   vulnerability (CVE-2022-25881)
 * Node.js: Permissions policies can be bypassed via process.mainModule
   (CVE-2023-23918)
 * Node.js: insecure loading of ICU data through ICU_DATA environment variable
   (CVE-2023-23920)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.


SOLUTION

For details on how to apply this update, which includes the changes described in
this advisory, refer to:


https://access.redhat.com/articles/11258


AFFECTED PRODUCTS

 * Red Hat Enterprise Linux for x86_64 8 x86_64
 * Red Hat Enterprise Linux for IBM z Systems 8 s390x
 * Red Hat Enterprise Linux for Power, little endian 8 ppc64le
 * Red Hat Enterprise Linux for ARM 64 8 aarch64


FIXES

 * BZ - 2134609 - CVE-2022-3517 nodejs-minimatch: ReDoS via the braceExpand
   function
 * BZ - 2156324 - CVE-2021-35065 glob-parent: Regular Expression Denial of
   Service
 * BZ - 2165824 - CVE-2022-25881 http-cache-semantics: Regular Expression Denial
   of Service (ReDoS) vulnerability
 * BZ - 2168631 - CVE-2022-4904 c-ares: buffer overflow in config_sortlist() due
   to missing string length check
 * BZ - 2170644 - CVE-2022-38900 decode-uri-component: improper input validation
   resulting in DoS
 * BZ - 2171935 - CVE-2023-23918 Node.js: Permissions policies can be bypassed
   via process.mainModule
 * BZ - 2172217 - CVE-2023-23920 Node.js: insecure loading of ICU data through
   ICU_DATA environment variable
 * BZ - 2175826 - nodejs:14/nodejs: Rebase to the latest Nodejs 14 release
   [rhel-8] [rhel-8.7.0.z]


CVES

 * CVE-2021-35065
 * CVE-2022-3517
 * CVE-2022-4904
 * CVE-2022-25881
 * CVE-2022-38900
 * CVE-2023-23918
 * CVE-2023-23920


REFERENCES

 * https://access.redhat.com/security/updates/classification/#important

Note: More recent versions of these packages may be available. Click a package
name for more details.


RED HAT ENTERPRISE LINUX FOR X86_64 8

SRPM nodejs-14.21.3-1.module+el8.7.0+18531+81d21ca6.src.rpm SHA-256:
44ecf683fb50fcfa7a41c62c9291263cc950165e8c2939275311777e59a060c4
nodejs-nodemon-2.0.20-3.module+el8.7.0+18531+81d21ca6.src.rpm SHA-256:
e42e3dd7e6b7e305b0c95059b6fea2084fe3c9e5d738e350fe25b0514866716c
nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.src.rpm SHA-256:
550d2f0197e4e69e9cfba813170d0fab3911749327f0c30db022424702287709 x86_64
nodejs-docs-14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch.rpm SHA-256:
0b97cf38e02e77e413bbc686b35cc932815e4c8d3bb675581197e5f27ab3462c
nodejs-nodemon-2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch.rpm SHA-256:
634fedd700ff6b3357556b9902f9551dc06a42f5e618cf388e976404486b0694
nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.noarch.rpm SHA-256:
d0ffb55491051b33ed7a0c9d1dfeb65ef76f367c9df1065140d0fa830091b169
nodejs-14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64.rpm SHA-256:
2ac40fc6e3a1aa71e037c22f6722d1ffbc31daefab2d22ccfa6e4184e1a44a90
nodejs-debuginfo-14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64.rpm SHA-256:
5c3eeb8de6e8ab2a4529f23fda4b10811b56b0f878cab6578bb4ddc313e20e9b
nodejs-debugsource-14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64.rpm SHA-256:
43887b4788d4e0aa91075bb59bcbdfe55e6c139897e1a261a2bc1c3aba19e2af
nodejs-devel-14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64.rpm SHA-256:
75063eaf7ba545173b2735995080ed64e0c94b883a74e6e4146f9da4edbaa5ac
nodejs-full-i18n-14.21.3-1.module+el8.7.0+18531+81d21ca6.x86_64.rpm SHA-256:
fded66ddab1607995b625b14a30e21eaae2960f6e3591f87a890db2a6c720c4c
npm-6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.x86_64.rpm SHA-256:
66e91f680e5b39549d2ce1835b6ff9cc857e828539b051ffc2942219f71030a7


RED HAT ENTERPRISE LINUX FOR IBM Z SYSTEMS 8

SRPM nodejs-14.21.3-1.module+el8.7.0+18531+81d21ca6.src.rpm SHA-256:
44ecf683fb50fcfa7a41c62c9291263cc950165e8c2939275311777e59a060c4
nodejs-nodemon-2.0.20-3.module+el8.7.0+18531+81d21ca6.src.rpm SHA-256:
e42e3dd7e6b7e305b0c95059b6fea2084fe3c9e5d738e350fe25b0514866716c
nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.src.rpm SHA-256:
550d2f0197e4e69e9cfba813170d0fab3911749327f0c30db022424702287709 s390x
nodejs-docs-14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch.rpm SHA-256:
0b97cf38e02e77e413bbc686b35cc932815e4c8d3bb675581197e5f27ab3462c
nodejs-nodemon-2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch.rpm SHA-256:
634fedd700ff6b3357556b9902f9551dc06a42f5e618cf388e976404486b0694
nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.noarch.rpm SHA-256:
d0ffb55491051b33ed7a0c9d1dfeb65ef76f367c9df1065140d0fa830091b169
nodejs-14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x.rpm SHA-256:
370077a12590c29095f95e95c40209ff0d183065724676c996f93d28f043cdea
nodejs-debuginfo-14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x.rpm SHA-256:
f13b7a902c7259a7e28fda263eaaed39c79aa4b5a4fef03243c00b078f1289a1
nodejs-debugsource-14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x.rpm SHA-256:
eb056926acd5daea32bbce87b4083bd03f6d670b052baac93e3f617ea5f9a07e
nodejs-devel-14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x.rpm SHA-256:
a1d0eaaf53bfd12cff45caceb353f2ad61813e55c5b2d4691fe611a6a1fb96d3
nodejs-full-i18n-14.21.3-1.module+el8.7.0+18531+81d21ca6.s390x.rpm SHA-256:
a3dc322f9c7ff92a407f0b6747243ce25bd44dffdefb2b4eb4ce3cf4972ae664
npm-6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.s390x.rpm SHA-256:
74acf369540a2afc5e37a7fe0adb8e794fe750705663ee4e2a3de1b696bb404b


RED HAT ENTERPRISE LINUX FOR POWER, LITTLE ENDIAN 8

SRPM nodejs-14.21.3-1.module+el8.7.0+18531+81d21ca6.src.rpm SHA-256:
44ecf683fb50fcfa7a41c62c9291263cc950165e8c2939275311777e59a060c4
nodejs-nodemon-2.0.20-3.module+el8.7.0+18531+81d21ca6.src.rpm SHA-256:
e42e3dd7e6b7e305b0c95059b6fea2084fe3c9e5d738e350fe25b0514866716c
nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.src.rpm SHA-256:
550d2f0197e4e69e9cfba813170d0fab3911749327f0c30db022424702287709 ppc64le
nodejs-14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le.rpm SHA-256:
34c095d6aefd60f51e1474e83a949af2f1b31d3858a4a1a25d5651084e7943e0
nodejs-debuginfo-14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le.rpm SHA-256:
c8c1b81d204b42a7bc19a64b8301bcbcdfbeb7cb260e469a820512831aa4d768
nodejs-debugsource-14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le.rpm SHA-256:
a2bc62ee6745283c5a93976851551cbd48fd0be24a2c7a4b7564903d91870d3b
nodejs-devel-14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le.rpm SHA-256:
cdb8e8349850a7f601f458baec3fc48c45988496e90d8b56dfc5adf7fd13feb6
nodejs-docs-14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch.rpm SHA-256:
0b97cf38e02e77e413bbc686b35cc932815e4c8d3bb675581197e5f27ab3462c
nodejs-full-i18n-14.21.3-1.module+el8.7.0+18531+81d21ca6.ppc64le.rpm SHA-256:
a51892065242d042cbeaefef6bf9af4e5206cd096fc6680f1865c0811026b13d
nodejs-nodemon-2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch.rpm SHA-256:
634fedd700ff6b3357556b9902f9551dc06a42f5e618cf388e976404486b0694
nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.noarch.rpm SHA-256:
d0ffb55491051b33ed7a0c9d1dfeb65ef76f367c9df1065140d0fa830091b169
npm-6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.ppc64le.rpm SHA-256:
feb53848ff229bc811e0ea26013160ff9357c27c9c043f76a085e4f073ea6487


RED HAT ENTERPRISE LINUX FOR ARM 64 8

SRPM nodejs-14.21.3-1.module+el8.7.0+18531+81d21ca6.src.rpm SHA-256:
44ecf683fb50fcfa7a41c62c9291263cc950165e8c2939275311777e59a060c4
nodejs-nodemon-2.0.20-3.module+el8.7.0+18531+81d21ca6.src.rpm SHA-256:
e42e3dd7e6b7e305b0c95059b6fea2084fe3c9e5d738e350fe25b0514866716c
nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.src.rpm SHA-256:
550d2f0197e4e69e9cfba813170d0fab3911749327f0c30db022424702287709 aarch64
nodejs-docs-14.21.3-1.module+el8.7.0+18531+81d21ca6.noarch.rpm SHA-256:
0b97cf38e02e77e413bbc686b35cc932815e4c8d3bb675581197e5f27ab3462c
nodejs-nodemon-2.0.20-3.module+el8.7.0+18531+81d21ca6.noarch.rpm SHA-256:
634fedd700ff6b3357556b9902f9551dc06a42f5e618cf388e976404486b0694
nodejs-packaging-23-3.module+el8.3.0+6519+9f98ed83.noarch.rpm SHA-256:
d0ffb55491051b33ed7a0c9d1dfeb65ef76f367c9df1065140d0fa830091b169
nodejs-14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64.rpm SHA-256:
24ffbb207cb83c74fe18a9f3e8c11706d023c10118bbaf08f70b999752dbe45c
nodejs-debuginfo-14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64.rpm SHA-256:
cf1284e59d4a0c6b44637f3296813af3992c3e1fc1a13d7c37a21ce9e7821544
nodejs-debugsource-14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64.rpm SHA-256:
6eff8e3abde4762ef7b7ef711319359c761d13defac0ff1a1cafaa2367194016
nodejs-devel-14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64.rpm SHA-256:
69c1ea5e19d12147d25d1837510fd7094480027531a0b385d2c4fd41f2c3bf4d
nodejs-full-i18n-14.21.3-1.module+el8.7.0+18531+81d21ca6.aarch64.rpm SHA-256:
b858cd730c17d631d32903e7eece18941f3c4df746718bcbb53296b5e5fe7958
npm-6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6.aarch64.rpm SHA-256:
cc5c4e683a73400d87076e18e83585564272d1076f879606be9543c4347738d2

The Red Hat security contact is secalert@redhat.com. More contact details at
https://access.redhat.com/security/team/contact/.


Red Hat


QUICK LINKS

 * Downloads
 * Subscriptions
 * Support Cases
 * Customer Service
 * Product Documentation


HELP

 * Contact Us
 * Customer Portal FAQ
 * Log-in Assistance


SITE INFO

 * Trust Red Hat
 * Browser Support Policy
 * Accessibility
 * Awards and Recognition
 * Colophon


RELATED SITES

 * redhat.com
 * developers.redhat.com
 * connect.redhat.com
 * cloud.redhat.com


ABOUT

 * Red Hat Subscription Value
 * About Red Hat
 * Red Hat Jobs

All systems operational
Copyright © 2023 Red Hat, Inc.
 * Privacy Statement
 * Customer Portal Terms of Use
 * All Policies and Guidelines
 * Cookie-Einstellungen

Twitter

access.redhat.com Open in urlscan Pro 2a02:26f0:3500:18::1724:a291 Public Scan

Form analysis 1 forms found in the DOM

Name: topSearchForm — GET /search/browse/search/

Text Content

access.redhat.com Open in urlscan Pro
2a02:26f0:3500:18::1724:a291 Public Scan

Form analysis
1 forms found in the DOM