{"type":"TYPE_SECURITY","shortCode":"RL","name":"RLSA-2023:4536","synopsis":"Moderate: nodejs:18 security, bug fix, and enhancement update","severity":"SEVERITY_MODERATE","topic":"An update is available for nodejs-nodemon, module.nodejs, nodejs, module.nodejs-nodemon, module.nodejs-packaging, nodejs-packaging.\nThis update affects Rocky Linux 8.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe package has been upgraded to a later upstream version: nodejs (18.16.1). (BZ#2223630, BZ#2223631, BZ#2223632, BZ#2223633, BZ#2223635, BZ#2223642)\n\nSecurity Fix(es):\n\n* nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)\n\n* nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)\n\n* nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)\n\n* nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:18\/nodejs: Don't assume FIPS is disabled by default [rhel-8] (BZ#2223639)","solution":null,"affectedProducts":["Rocky Linux 8"],"fixes":[{"ticket":"2219824","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2219824","description":""},{"ticket":"2219838","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2219838","description":""},{"ticket":"2219841","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2219841","description":""},{"ticket":"2219842","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2219842","description":""},{"ticket":"2223630","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2223630","description":"The package has been upgraded to a later upstream version: nodejs (18.16.1). (BZ#2223630, BZ#2223631, BZ#2223632, BZ#2223633, BZ#2223635, BZ#2223642)"},{"ticket":"2223642","sourceBy":"Red Hat","sourceLink":"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=2223642","description":""}],"cves":[{"name":"CVE-2023-30581","sourceBy":"MITRE","sourceLink":"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-30581","cvss3ScoringVector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:N","cvss3BaseScore":"7.5","cwe":"UNKNOWN"},{"name":"CVE-2023-30588","sourceBy":"MITRE","sourceLink":"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-30588","cvss3ScoringVector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:L","cvss3BaseScore":"5.3","cwe":"UNKNOWN"},{"name":"CVE-2023-30589","sourceBy":"MITRE","sourceLink":"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-30589","cvss3ScoringVector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:N","cvss3BaseScore":"7.5","cwe":"UNKNOWN"},{"name":"CVE-2023-30590","sourceBy":"MITRE","sourceLink":"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-30590","cvss3ScoringVector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N","cvss3BaseScore":"5.3","cwe":"UNKNOWN"}],"references":[],"publishedAt":"2023-10-06T23:10:12.373291Z","rpms":{"Rocky Linux 8":{"nvras":["nodejs-1:18.16.1-1.module+el8.8.0+1413+a47876c7.aarch64.rpm","nodejs-1:18.16.1-1.module+el8.8.0+1413+a47876c7.src.rpm","nodejs-debuginfo-1:18.16.1-1.module+el8.8.0+1413+a47876c7.aarch64.rpm","nodejs-debugsource-1:18.16.1-1.module+el8.8.0+1413+a47876c7.aarch64.rpm","nodejs-devel-1:18.16.1-1.module+el8.8.0+1413+a47876c7.aarch64.rpm","nodejs-docs-1:18.16.1-1.module+el8.8.0+1413+a47876c7.noarch.rpm","nodejs-full-i18n-1:18.16.1-1.module+el8.8.0+1413+a47876c7.aarch64.rpm","nodejs-nodemon-0:2.0.20-2.module+el8.7.0+1177+510ae886.noarch.rpm","nodejs-nodemon-0:2.0.20-2.module+el8.7.0+1177+510ae886.src.rpm","nodejs-packaging-0:2021.06-4.module+el8.7.0+1072+5b168780.noarch.rpm","nodejs-packaging-0:2021.06-4.module+el8.7.0+1072+5b168780.src.rpm","nodejs-packaging-bundler-0:2021.06-4.module+el8.7.0+1072+5b168780.noarch.rpm","npm-1:9.5.1-1.18.16.1.1.module+el8.8.0+1413+a47876c7.aarch64.rpm","nodejs-1:18.16.1-1.module+el8.8.0+1413+a47876c7.x86_64.rpm","nodejs-debuginfo-1:18.16.1-1.module+el8.8.0+1413+a47876c7.x86_64.rpm","nodejs-debugsource-1:18.16.1-1.module+el8.8.0+1413+a47876c7.x86_64.rpm","nodejs-devel-1:18.16.1-1.module+el8.8.0+1413+a47876c7.x86_64.rpm","nodejs-full-i18n-1:18.16.1-1.module+el8.8.0+1413+a47876c7.x86_64.rpm","npm-1:9.5.1-1.18.16.1.1.module+el8.8.0+1413+a47876c7.x86_64.rpm"]}},"rebootSuggested":false,"buildReferences":[]}