Most recent entries from all

ALSA-2023:1582 — Moderate: nodejs:16 security, bug fix, and enhancement update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

* glob-parent: Regular Expression Denial of Service (CVE-2021-35065) * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904) * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881) * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918) * Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919) * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936) * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920) * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-01626

Withdrawn: BELL-CVE-2023-23919 — CVE-2023-23919 does not affect BellSoft software

Withdrawn by the publisher.

BIT-node-2023-23919

Affected: Bitnami: node

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

certfr-2023-avi-0337 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Elles permettent à u…

certfr-2023-avi-0337

CLEANSTART-2026-BC88779 — Security fix for CVE-2023-23919 applied in: nodejs 18.14.1-r0

Affected: CleanStart: nodejs

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-235826

fkie_cve-2023-23919

FSA-202302 — Festo: Several vulnerabilities in FactoryViews

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

GHSA-mfq6-mjjx-mp7f

gsd-2023-23919

msrc_CVE-2023-23919 — A cryptographic vulnerability exists in Node.js <19.2.0 <18.14.1 <16.19.1 <14.21.3 that in some cases did does not clea…

msrc_CVE-2023-23919

openSUSE-SU-2024:12725-1 — corepack18-18.14.2-1.1 on GA media

corepack18-18.14.2-1.1 on GA media

SUSE-SU-2023:0609-1 — Security update for nodejs16

Security update for nodejs16

Withdrawn: UBUNTU-CVE-2023-23919

Withdrawn by the publisher.

Affected: Ubuntu:24.04:LTS: nodejs

WID-SEC-W-2023-0414 — Node.js: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.