Most recent entries from all

ALSA-2024:1687 — Important: nodejs:20 security update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: nodejs-packaging-bundler, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809) * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019) * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892) * nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896) * nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891) * nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890) * nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

bdu:2024-04313

BELL-CVE-2024-22017

Affected: Alpaquita:stream: nodejs, BellSoft Hardened Containers:stream: nodejs

BIT-node-2024-22017

Affected: Bitnami: node

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

certfr-2024-avi-0538 — De multiples vulnérabilités ont été découvertes dans Tenable Identity Exposure. Certaines d'entre elles permettent à un…

certfr-2024-avi-0538

EUVD-2026-236192

fkie_cve-2024-22017

GHSA-vr4q-vx84-9g5x

gsd-2024-22017

ICSA-24-319-08 — Siemens SINEC INS

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be mislead by removing adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue. The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control cha…

msrc_CVE-2024-22017 — setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows t…

msrc_CVE-2024-22017

openSUSE-SU-2024:13697-1 — corepack20-20.11.1-1.1 on GA media

corepack20-20.11.1-1.1 on GA media

SUSE-SU-2024:0643-1 — Security update for nodejs20

Security update for nodejs20

Withdrawn: UBUNTU-CVE-2024-22017

Withdrawn by the publisher.

Affected: Ubuntu:25.04: nodejs

WID-SEC-W-2024-0393 — Node.js: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder seine Privilegien zu erweitern.