rpm package
almalinux/nodejs-packaging
pkg:rpm/almalinux/nodejs-packaging
Vulnerabilities (172)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-3918 | Cri | 9.8 | < 25-1.module_el8.5.0+246+05401605 | 25-1.module_el8.5.0+246+05401605 | Nov 13, 2021 | json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | |
| CVE-2021-22960 | Med | 6.5 | < 25-1.module_el8.5.0+246+05401605 | 25-1.module_el8.5.0+246+05401605 | Nov 3, 2021 | The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. | |
| CVE-2021-22930 | Cri | 9.8 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Oct 7, 2021 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. | |
| CVE-2021-3807 | Hig | 7.5 | < 25-1.module_el8.5.0+246+05401605 | 25-1.module_el8.5.0+246+05401605 | Sep 17, 2021 | ansi-regex is vulnerable to Inefficient Regular Expression Complexity | |
| CVE-2021-37712 | Hig | 8.2 | < 23-3.module_el8.5.0+2618+8d46dafd | 23-3.module_el8.5.0+2618+8d46dafd | Aug 31, 2021 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This | |
| CVE-2021-37701 | Hig | 8.2 | < 23-3.module_el8.5.0+2618+8d46dafd | 23-3.module_el8.5.0+2618+8d46dafd | Aug 31, 2021 | The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This i | |
| CVE-2021-22940 | Hig | 7.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Aug 16, 2021 | Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. | |
| CVE-2021-22939 | Med | 5.3 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Aug 16, 2021 | If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. | |
| CVE-2021-22931 | Cri | 9.8 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Aug 16, 2021 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacki | |
| CVE-2021-32804 | Hig | 8.2 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Aug 3, 2021 | The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into rel | |
| CVE-2021-32803 | Hig | 8.2 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Aug 3, 2021 | The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not e | |
| CVE-2021-22918 | Med | 5.3 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Jul 12, 2021 | Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. Th | |
| CVE-2020-28469 | Med | 5.3 | < 25-1.module_el8.5.0+246+05401605 | 25-1.module_el8.5.0+246+05401605 | Jun 3, 2021 | This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. | |
| CVE-2021-33502 | Hig | 7.5 | < 25-1.module_el8.5.0+246+05401605 | 25-1.module_el8.5.0+246+05401605 | May 24, 2021 | The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs. | |
| CVE-2021-23343 | Med | 5.3 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | May 4, 2021 | All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity. | |
| CVE-2021-23362 | Med | 5.3 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Mar 23, 2021 | The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity. | |
| CVE-2021-27290 | Hig | 7.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Mar 12, 2021 | ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option. | |
| CVE-2021-22884 | Hig | 7.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Mar 3, 2021 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker control | |
| CVE-2021-22883 | Hig | 7.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Mar 3, 2021 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then th | |
| CVE-2020-8287 | Med | 6.5 | < 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e | Jan 6, 2021 | Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggl |
- affected < 25-1.module_el8.5.0+246+05401605fixed 25-1.module_el8.5.0+246+05401605
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- affected < 25-1.module_el8.5.0+246+05401605fixed 25-1.module_el8.5.0+246+05401605
The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
- affected < 25-1.module_el8.5.0+246+05401605fixed 25-1.module_el8.5.0+246+05401605
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
- affected < 23-3.module_el8.5.0+2618+8d46dafdfixed 23-3.module_el8.5.0+2618+8d46dafd
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This
- affected < 23-3.module_el8.5.0+2618+8d46dafdfixed 23-3.module_el8.5.0+2618+8d46dafd
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This i
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacki
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into rel
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not e
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. Th
- affected < 25-1.module_el8.5.0+246+05401605fixed 25-1.module_el8.5.0+246+05401605
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
- affected < 25-1.module_el8.5.0+246+05401605fixed 25-1.module_el8.5.0+246+05401605
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker control
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then th
- affected < 17-3.module_el8.4.0+2224+b07ac28efixed 17-3.module_el8.4.0+2224+b07ac28e
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggl
Page 7 of 9