Linux · Security advisory · April 4, 2023

RHSA-2023:1583: Security update for 8 packages

RHSA-2023:1583, released April 4, 2023, fixes 7 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0221
82nd percentile

Priority of the 7 CVEs

Patch now 0 Urgent 0 High 7 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsRHEL 81:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-develRHEL 81:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-docsRHEL 81:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-full-i18nRHEL 81:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-nodemonRHEL 80:2.0.20-2.module+el8.7.0+18445+9493b6ea
nodejs-packagingRHEL 80:2021.06-4.module+el8.7.0+15582+19c314fa
nodejs-packaging-bundlerRHEL 80:2021.06-4.module+el8.7.0+15582+19c314fa
npmRHEL 81:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-23919 Node.js 14 and 3 others: Cryptographic Issues - Generic (CWE-310) 8.6 0.0221 None reported
High CVE-2023-23918 Node.js 14 and 3 others: Incorrect Authorization 8.6 0.0202 None reported
High CVE-2021-35065 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0170 None reported
High CVE-2022-25881 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0161 None reported
High CVE-2023-24807 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 8.6 0.0132 None reported
High CVE-2023-23936 CRLF Injection in Nodejs ‘undici’ via host 8.6 0.0113 None reported
High CVE-2023-23920 Node.js 14 and 3 others: Untrusted Search Path (CWE-426) 8.6 0.0045 None reported
Showing 1 to 7 of 7 1