ALAS2023-2023-084: Security update for 10 packages

ALAS2023-2023-084, released February 17, 2023, fixes 18 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.9249

99th percentile

Priority of the 18 CVEs

Patch now 0
                                Urgent 1
                                High 16
                                Routine 1

Fixed package versions

Product	Release	Fixed in
nodejs	amzn 2023	1:18.12.1-1.amzn2023.0.2
nodejs-debuginfo	amzn 2023	1:18.12.1-1.amzn2023.0.2
nodejs-debugsource	amzn 2023	1:18.12.1-1.amzn2023.0.2
nodejs-devel	amzn 2023	1:18.12.1-1.amzn2023.0.2
nodejs-docs	amzn 2023	1:18.12.1-1.amzn2023.0.2
nodejs-full-i18n	amzn 2023	1:18.12.1-1.amzn2023.0.2
nodejs-libs	amzn 2023	1:18.12.1-1.amzn2023.0.2
nodejs-libs-debuginfo	amzn 2023	1:18.12.1-1.amzn2023.0.2
npm	amzn 2023	1:8.19.2-1.18.12.1.1.amzn2023.0.2
v8-devel	amzn 2023	2:10.2.154.15-1.18.12.1.1.amzn2023.0.2

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2022-3786	OpenSSL: CVE-2022-3786 X.509 certificate verification buffer overrun	7.5	0.9249	More likely
High	CVE-2022-3602	OpenSSL: CVE-2022-3602 X.509 certificate verification buffer overrun	7.5	0.9077	N/A
High	CVE-2022-32214	Node.js 14 and 2 others: HTTP Request Smuggling (CWE-444)	9.1	0.8183	None reported
High	CVE-2022-32215	Node.js 14 and 2 others: HTTP Request Smuggling (CWE-444)	9.1	0.7024	None reported
High	CVE-2022-32213	Node.js 14 and 2 others: HTTP Request Smuggling (CWE-444)	9.1	0.4484	None reported
High	CVE-2022-21824	Node.js 14 and 3 others: Modification of Assumed-Immutable Data (MAID) (CWE-471)	9.8	0.2151	None reported
High	CVE-2022-43548	Node.js 14 and 2 others: OS Command Injection (CWE-78)	9.8	0.1484	None reported
High	CVE-2021-44532	Node.js 14 and 8 others: Improper Following of a Certificate's Chain of Trust (CWE-296)	9.8	0.1036	None reported
High	CVE-2021-44533	Node.js 14 and 8 others: Improper Certificate Validation (CWE-295)	9.8	0.0936	None reported
High	CVE-2021-44531	Node.js 14 and 8 others: Improper Certificate Validation (CWE-295)	9.8	0.0837	None reported
High	CVE-2022-32212	Node.js 14 and 2 others: Improper Access Control - Generic (CWE-284)	8.1	0.0643	None reported
High	CVE-2021-22959	Node.js 14 and 2 others: HTTP Request Smuggling (CWE-444)	9.8	0.0316	None reported
High	CVE-2022-35256	Node.js 14 and 2 others: HTTP Request Smuggling (CWE-444)	9.8	0.0276	None reported
High	CVE-2021-43616	nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog...	9.8	0.0262	None reported
High	CVE-2021-22960	Node.js 14 and 2 others: HTTP Request Smuggling (CWE-444)	9.8	0.0247	None reported
High	CVE-2022-35255	Node.js 16 and 2 others: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)	9.1	0.0209	None reported
High	CVE-2022-32223	Node.js 14 and 2 others: Uncontrolled Search Path Element (CWE-427)	7.3	0.0175	None reported
Routine	CVE-2022-32222	Node.js 18: Cryptographic Issues - Generic (CWE-310)	5.3	0.0219	None reported

Also fixes CVE-2022-3786

ALAS2023-2023-051
openssl, openssl-debuginfo, openssl-debugsource and 4 more on amzn 2023
Node.js 18 18.12.1
Node.js 18
libssl3t64 3.0.5-2ubuntu2
libssl3t64 on Ubuntu 24.10 (oracular)
libssl3t64 3.0.5-2ubuntu2
libssl3t64 on Ubuntu 25.04 (plucky)
openssl 3.0.5-2ubuntu2
openssl on Ubuntu 24.10 (oracular)
openssl 3.0.5-2ubuntu2
openssl on Ubuntu 25.04 (plucky)
libssl3 3.0.2-0ubuntu1.7
libssl3 on Ubuntu 22.04.1 LTS (jammy)
openssl 3.0.2-0ubuntu1.7
openssl on Ubuntu 22.04.1 LTS (jammy)

Vendor advisory

https://alas.aws.amazon.com/AL2023/ALAS-2023-084.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alas2023-2023-084">ALAS2023-2023-084 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.