Linux · Security advisory · April 12, 2023

ELSA-2023-1743: Security update for 7 packages

ELSA-2023-1743, released April 12, 2023, fixes 6 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
6
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.2361
97th percentile

Priority of the 6 CVEs

Patch now 0 Urgent 0 High 6 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsol 81:14.21.3-1.module+el8.7.0+21031+52889874
nodejs-develol 81:14.21.3-1.module+el8.7.0+21031+52889874
nodejs-docsol 81:14.21.3-1.module+el8.7.0+21031+52889874
nodejs-full-i18nol 81:14.21.3-1.module+el8.7.0+21031+52889874
nodejs-nodemonol 80:2.0.20-3.module+el8.7.0+21031+52889874
nodejs-packagingol 80:23-3.module+el8.3.0+7818+6cd30d85
npmol 81:6.14.18-1.14.21.3.1.module+el8.7.0+21031+52889874

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2022-38900 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.2361 None reported
High CVE-2023-23918 Node.js 14 and 3 others: Incorrect Authorization 8.6 0.0202 None reported
High CVE-2021-35065 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0170 None reported
High CVE-2022-25881 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0161 None reported
High CVE-2022-4904 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0123 None reported
High CVE-2023-23920 Node.js 14 and 3 others: Untrusted Search Path (CWE-426) 8.6 0.0045 None reported
Showing 1 to 6 of 6 1