Linux · Security advisory · September 27, 2021
ELSA-2021-3666: Security update for 7 packages
ELSA-2021-3666, released September 27, 2021, fixes 8 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.3645
98th percentile
Priority of the 8 CVEs
Patch now 0
Urgent 0
High 6
Routine 2
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| nodejs | ol 8 | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| nodejs-devel | ol 8 | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| nodejs-docs | ol 8 | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| nodejs-full-i18n | ol 8 | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| nodejs-nodemon | ol 8 | 0:2.0.3-1.module+el8.3.0+7818+6cd30d85 |
| nodejs-packaging | ol 8 | 0:23-3.module+el8.3.0+7818+6cd30d85 |
| npm | ol 8 | 1:6.14.14-1.14.17.5.1.module+el8.4.0+20313+f90c2973 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2021-22930 | Node.js 14 and 2 others: Use After Free (CWE-416) | 9.8 | 0.3645 | None reported | |
| High | CVE-2021-22931 | Node.js 14 and 2 others: Improper Null Termination (CWE-170) | 9.8 | 0.2195 | None reported | |
| High | CVE-2021-32804 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 8.1 | 0.1507 | None reported | |
| High | CVE-2021-22940 | Node.js 14 and 2 others: Use After Free (CWE-416) | 7.5 | 0.1386 | None reported | |
| High | CVE-2021-32803 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 8.1 | 0.0780 | None reported | |
| High | CVE-2021-23343 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0222 | None reported | |
| Routine | CVE-2021-22939 | Node.js 14 and 2 others: Improper Certificate Validation (CWE-295) | 5.3 | 0.1473 | None reported | |
| Routine | CVE-2021-3672 | Node.js 14 and 2 others: A flaw was found in c-ares library, where a missing input validation check of host names returned by… | 5.6 | 0.0281 | None reported |
Showing 1 to 8 of 8
1