[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 3137-1] nodejs security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3137-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Sylvain Beucler
October 05, 2022                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : nodejs
Version        : 10.24.0~dfsg-1~deb10u2
CVE ID         : CVE-2021-22930 CVE-2021-22939 CVE-2021-22940 CVE-2022-21824 
                 CVE-2022-32212
Debian Bug     : 1004177

Multiple vulnerabilities were discovered in Node.js, a JavaScript
runtime environment, which could result in memory corruption, invalid
certificate validation, prototype pollution or command injection.

CVE-2021-22930, CVE-2021-22940

    Use after free attack where an attacker might be able to exploit
    the memory corruption, to change process behavior.

CVE-2021-22939

    If the Node.js https API was used incorrectly and "undefined" was
    in passed for the "rejectUnauthorized" parameter, no error was
    returned and connections to servers with an expired certificate
    would have been accepted.

CVE-2022-21824

    Due to the formatting logic of the "console.table()" function it
    was not safe to allow user controlled input to be passed to the
    "properties" parameter while simultaneously passing a plain object
    with at least one property as the first parameter, which could be
    "__proto__".

CVE-2022-32212

    OS Command Injection vulnerability due to an insufficient
    IsAllowedHost check that can easily be bypassed because
    IsIPAddress does not properly check if an IP address is invalid
    before making DBS requests allowing rebinding attacks.

For Debian 10 buster, these problems have been fixed in version
10.24.0~dfsg-1~deb10u2.

We recommend that you upgrade your nodejs packages.

For the detailed security status of nodejs please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/nodejs

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmM9n8cACgkQDTl9HeUl
XjBSsA//SMbXY5eKOi7aRdFmQbM9xEUvmz6SqrR6ods301RyqLo5Qdl6DX0lCtx8
SfKOoaD9v8V6iK+mO4qZ4SzmKzQlajywCnUkwxhIlbPtcB+ZTbQWfbQcYTS1LyQZ
/0PleFVwWY90MQt5z5GyxNHth9OIrG9t3hyt53iAE2Yl+xUrWaZF1f7KVMAKZ8jp
z5/Cu6SQtD4QCLbC/r05GcFCWz2C43PMNrGzGnkN5ZmDXZoMPX1FwF7BZAg31y2r
Iux+fAq+wcg69Mheuwyn56xV34rjfyKkR/NERYDchDN8unjvGaGRQVGJ7koT3zHD
tS4eQjhuXLioLvTOJdfy5M44qiQbKsMVOnefgecOvh0fWHLSB4zTmoXBpEIc7i+f
0W60W+6CnjTWMMlWGHIErtZgOfJKyyFKW3zzNyVWEdOhB8o0Cg9z1Zlx8/UxAMiV
yVKFAGcX/VG2RM0eTuybrE+rvF2Go1fZSns8k/61/0855Rm1DRRgPWGNJ37bz+Qo
88Vxlh9Bpiq8ARsXsCc/En0w4bUXQp3zc3yakZxecgL7ZKfle7ae53uGoulnqRJ9
kHltq40DevOBezsRc+NFNDul4Lb4Egr9mmG42RyRgMMMuigDMa1ncscXBQV6WeAx
z7LPpx0Czniq3Omac8Hdis9BFZaqDCaR/dLn69FqBjJJXcsRqw8=
=40S6
-----END PGP SIGNATURE-----


Reply to: