SB2023040810 - Red Hat Enterprise Linux 8 update for the nodejs:16 module
Published: April 8, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2021-35065)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing regular expressions. A remote attacker can trigger resource exhaustion and perform a regular expression denial of service (ReDoS) attack.
2) Buffer overflow (CVE-ID: CVE-2022-4904)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the config_sortlist() function. A local user can trigger memory corruption and perform a denial of service (DoS) attack.
3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2022-25881)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to regular expression denial of service that occurs when the server reads the cache policy from the request using this library. A remote unauthenticated attacker can send malicious request header values to the server and perform a denial of service attack.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-23918)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to improperly imposed security restrictions within the process.mainModule.require() method. A remote user can access non authorized modules.
5) Resource management error (CVE-ID: CVE-2023-23919)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to in some cases Node.js does does not clear the OpenSSL error stack after operations that may set it. A remote attacker can trigger false positive errors during subsequent cryptographic operations on the same thread and perform a denial of service (DoS) attack.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-23920)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to application insecurely loads ICU data through ICU_DATA environment variable with elevated privileges. A remote user can gain access to potentially sensitive information.
7) HTTP response splitting (CVE-ID: CVE-2023-23936)
The vulnerability allows a remote attacker to perform HTTP splitting attacks.
The vulnerability exists due to software does not correctly process CRLF character sequences when handling HTTP "Host" header. A remote attacker can send specially crafted request containing CRLF sequence and make the application to send a split HTTP response.
Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.
8) Incorrect Regular Expression (CVE-ID: CVE-2023-24807)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when user-supplied input within the `Headers.set()` and `Headers.append()` methods. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Remediation
Install update from vendor's website.