Linux · Security advisory · May 10, 2024

ELSA-2024-2780: Security update for 8 packages

ELSA-2024-2780, released May 10, 2024, fixes 5 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.8721
99th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 5 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsol 81:18.20.2-1.module+el8.9.0+90319+0b1e7189
nodejs-develol 81:18.20.2-1.module+el8.9.0+90319+0b1e7189
nodejs-docsol 81:18.20.2-1.module+el8.9.0+90319+0b1e7189
nodejs-full-i18nol 81:18.20.2-1.module+el8.9.0+90319+0b1e7189
nodejs-nodemonol 80:3.0.1-1.module+el8.9.0+90157+ed89dc20
nodejs-packagingol 80:2021.06-4.module+el8.9.0+90157+ed89dc20
nodejs-packaging-bundlerol 80:2021.06-4.module+el8.9.0+90157+ed89dc20
npmol 81:10.5.0-1.18.20.2.1.module+el8.9.0+90319+0b1e7189

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2024-27983 Node.js 18 and 2 others: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') 8.2 0.8721 None reported
High CVE-2024-28182 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.8199 None reported
High CVE-2024-22025 Node.js 18 and 2 others: Improper Resource Shutdown or Release 7.5 0.0131 None reported
High CVE-2024-27982 Node.js 18 and 2 others: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') 7.5 0.0116 None reported
High CVE-2024-25629 c-ares: This update for c-ares fixes the following issues: - CVE-2024-25629: out of bounds read in ares__read_line() (bsc#12... 7.5 0.0035 None reported
Showing 1 to 5 of 5 1