RHSA-2024:1687HighCVSS 8.1

Red Hat Security Advisory: nodejs:20 security update

Published
April 8, 2024
Last Modified
August 13, 2026

🔗 CVE IDs covered (7)

CVE-2024-22017 →CVE-2024-22019 →CVE-2023-46809 →CVE-2024-21890 →CVE-2024-21891 →CVE-2024-21892 →CVE-2024-21896 →

📋 Description

CVE-2023-46809 — nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) CVE-2024-21890 — nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write CVE-2024-21891 — nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization CVE-2024-21892 — nodejs: code injection and privilege escalation through Linux capabilities CVE-2024-21896 — nodejs: path traversal by monkey-patching buffer internals CVE-2024-22017 — nodejs: setuid() does not drop all privileges due to io_uring CVE-2024-22019 — nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

🎯 Affected products32

  • Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:20.11.1-1.module+el8.9.0+21380+12032667.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:20.11.1-1.module+el8.9.0+21380+12032667.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:20.11.1-1.module+el8.9.0+21380+12032667.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:20.11.1-1.module+el8.9.0+21380+12032667.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:20.11.1-1.module+el8.9.0+21380+12032667.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:20.11.1-1.module+el8.9.0+21380+12032667.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:20.11.1-1.module+el8.9.0+21380+12032667.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:20.11.1-1.module+el8.9.0+21380+12032667.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:20.11.1-1.module+el8.9.0+21380+12032667.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:20.11.1-1.module+el8.9.0+21380+12032667.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:20.11.1-1.module+el8.9.0+21380+12032667.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:20.11.1-1.module+el8.9.0+21380+12032667.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:20.11.1-1.module+el8.9.0+21380+12032667.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:20.11.1-1.module+el8.9.0+21380+12032667.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:20.11.1-1.module+el8.9.0+21380+12032667.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:20.11.1-1.module+el8.9.0+21380+12032667.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:20.11.1-1.module+el8.9.0+21380+12032667.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-docs-1:20.11.1-1.module+el8.9.0+21380+12032667.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:20.11.1-1.module+el8.9.0+21380+12032667.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:20.11.1-1.module+el8.9.0+21380+12032667.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:20.11.1-1.module+el8.9.0+21380+12032667.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:20.11.1-1.module+el8.9.0+21380+12032667.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +2 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (10)