Linux · Security advisory · March 21, 2024
ELSA-2024-1444: Security update for 7 packages
ELSA-2024-1444, released March 21, 2024, fixes 2 CVEs across 7 products. One of them is being exploited (CVE-2023-44487); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
2
None rated Critical
Exploited
1
CVE-2023-44487
Exploitation more likely
0
Vendor assessment
Highest EPSS
1.0000
99th percentile
Priority of the 2 CVEs
Patch now 1
Urgent 0
High 1
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| nodejs | ol 8 | 1:16.20.2-4.0.1.module+el8.9.0+90185+b2d3b544 |
| nodejs-devel | ol 8 | 1:16.20.2-4.0.1.module+el8.9.0+90185+b2d3b544 |
| nodejs-docs | ol 8 | 1:16.20.2-4.0.1.module+el8.9.0+90185+b2d3b544 |
| nodejs-full-i18n | ol 8 | 1:16.20.2-4.0.1.module+el8.9.0+90185+b2d3b544 |
| nodejs-nodemon | ol 8 | 0:3.0.1-1.module+el8.9.0+90185+b2d3b544 |
| nodejs-packaging | ol 8 | 0:26-1.module+el8.9.0+90185+b2d3b544 |
| npm | ol 8 | 1:8.19.4-1.16.20.2.4.0.1.module+el8.9.0+90185+b2d3b544 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2023-44487 | MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack | 7.5 | 1.0000 | KEVExploited | |
| High | CVE-2024-22019 | Node.js 18 and 2 others: Improper Resource Shutdown or Release | 8.1 | 0.0317 | None reported |
Showing 1 to 2 of 2
1