Linux · Security advisory · April 4, 2023

ALSA-2023:1583: Security update for 8 packages

ALSA-2023:1583, released April 4, 2023, fixes 7 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0221
82nd percentile

Priority of the 7 CVEs

Patch now 0 Urgent 0 High 7 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsalmalinux 81:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-develalmalinux 81:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-docsalmalinux 81:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-full-i18nalmalinux 81:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-nodemonalmalinux 82.0.20-2.module_el8.7.0+3497+c65299e7
nodejs-packagingalmalinux 82021.06-4.module_el8.7.0+3343+ea2b7901
nodejs-packaging-bundleralmalinux 82021.06-4.module_el8.7.0+3343+ea2b7901
npmalmalinux 81:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-23919 Node.js 14 and 3 others: Cryptographic Issues - Generic (CWE-310) 8.6 0.0221 None reported
High CVE-2023-23918 Node.js 14 and 3 others: Incorrect Authorization 8.6 0.0202 None reported
High CVE-2021-35065 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0170 None reported
High CVE-2022-25881 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0161 None reported
High CVE-2023-24807 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0132 None reported
High CVE-2023-23936 CRLF Injection in Nodejs ‘undici’ via host 8.6 0.0113 None reported
High CVE-2023-23920 Node.js 14 and 3 others: Untrusted Search Path (CWE-426) 8.6 0.0045 None reported
Showing 1 to 7 of 7 1