Linux · Security advisory · April 12, 2023

ALSA-2023:1743: Security update for 7 packages

ALSA-2023:1743, released April 12, 2023, fixes 6 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
6
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.2361
97th percentile

Priority of the 6 CVEs

Patch now 0 Urgent 0 High 6 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsalmalinux 81:14.21.3-1.module_el8.7.0+3551+53700ee8
nodejs-develalmalinux 81:14.21.3-1.module_el8.7.0+3551+53700ee8
nodejs-docsalmalinux 81:14.21.3-1.module_el8.7.0+3551+53700ee8
nodejs-full-i18nalmalinux 81:14.21.3-1.module_el8.7.0+3551+53700ee8
nodejs-nodemonalmalinux 82.0.20-3.module_el8.7.0+3551+53700ee8
nodejs-packagingalmalinux 823-3.module_el8.4.0+2522+3bd42762
npmalmalinux 81:6.14.18-1.14.21.3.1.module_el8.7.0+3551+53700ee8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2022-38900 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.2361 None reported
High CVE-2022-3517 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 9.8 0.0228 None reported
High CVE-2023-23918 Node.js 14 and 3 others: Incorrect Authorization 8.6 0.0202 None reported
High CVE-2021-35065 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0170 None reported
High CVE-2022-25881 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0161 None reported
High CVE-2023-23920 Node.js 14 and 3 others: Untrusted Search Path (CWE-426) 8.6 0.0045 None reported
Showing 1 to 6 of 6 1