nodejs:14 security, bug fix, and enhancement update

エラータID: AXSA:2022-3040:01

Release date: 
Wednesday, February 2, 2022 - 05:13
Subject: 
nodejs:14 security, bug fix, and enhancement update
Affected Channels: 
Asianux Server 8 for x86_64
Severity: 
Moderate
Description: 

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15).

Security Fix(es):

* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)
* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
* normalize-url: ReDoS for data URLs (CVE-2021-33502)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)
* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)
* ll[http:](http:) HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)
* ll[http:](http:) HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2020-28469
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
CVE-2020-7788
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
CVE-2021-22959
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
CVE-2021-22960
The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
CVE-2021-33502
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
CVE-2021-37701
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both `\` and `/` characters as path separators, however `\` is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but _not_ from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.
CVE-2021-37712
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.
CVE-2021-3807
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3918
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Modularity name: nodejs
Stream name: 14

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. nodejs-nodemon-2.0.15-1.module+el8+1390+aa748c28.src.rpm
    MD5: f5a1c3e2864e48c4d8cde2c38bb935c7
    SHA-256: 05fe18107a0018de4208d57a3b35d2f5c4d3cf1f113502c6438d7a4e1dc84022
    Size: 730.29 kB
  2. nodejs-packaging-23-3.module+el8+1390+aa748c28.src.rpm
    MD5: 547c6d2f86b048871c3d3d991b573e2f
    SHA-256: dc28ccf0d78a0c529d1d7389376646fe49057fdf608d462655f3688a2a4ff9d2
    Size: 26.54 kB
  3. nodejs-14.18.2-2.module+el8+1390+aa748c28.src.rpm
    MD5: 061cdd35fdcfc893ab4dac13c5b1a2cf
    SHA-256: ce3b87a3084c5fa82ebc26b9a14e61c9e0618f8787ce8bc43d79abc938cf4bc9
    Size: 66.91 MB

Asianux Server 8 for x86_64
  1. nodejs-nodemon-2.0.15-1.module+el8+1390+aa748c28.noarch.rpm
    MD5: 20766e7cd6b60c37d80e113d8bd8b922
    SHA-256: fa2a835f1397220832ef243600c1253a532f7c7f81bebadf83a68eeec14a7885
    Size: 578.86 kB
  2. nodejs-packaging-23-3.module+el8+1390+aa748c28.noarch.rpm
    MD5: 9cb2cf6de288a2966a4341f6b0200f62
    SHA-256: 7dca011daedcd7f98a3e0f33a33f65f0da145dfb7d3b94273acbd09b33ec22a7
    Size: 22.98 kB
  3. nodejs-14.18.2-2.module+el8+1390+aa748c28.x86_64.rpm
    MD5: 5adfa101fb74f02c7ea6ac17fd340fbb
    SHA-256: 9666810ad072b5a66358224c11b4d75c214c975d34a61852beb921f580c40fe7
    Size: 10.82 MB
  4. nodejs-debugsource-14.18.2-2.module+el8+1390+aa748c28.x86_64.rpm
    MD5: fffca45810de10a5cc00d61d4d470b27
    SHA-256: 3a259064981e431708b486c06fd4d09931ca8e9beea681046ff4cee7c59fd340
    Size: 11.01 MB
  5. nodejs-devel-14.18.2-2.module+el8+1390+aa748c28.x86_64.rpm
    MD5: 91c37f80f883b826f447abb641af5ff6
    SHA-256: 6b1a7ff8c6e73d4635dc4ac44a0bd52240c216981405b5572def3afcd0e3d099
    Size: 204.04 kB
  6. nodejs-docs-14.18.2-2.module+el8+1390+aa748c28.noarch.rpm
    MD5: 785ed7079d95fdc104e0cec10aae0b7c
    SHA-256: 9b803d8d2d78ab77ffff1064408d1a75eee769183f6eb46251da1e89210b4f93
    Size: 8.33 MB
  7. nodejs-full-i18n-14.18.2-2.module+el8+1390+aa748c28.x86_64.rpm
    MD5: fb20faf43aafcc244b41053bb9076717
    SHA-256: 91efe0af4876746c315472563eac2ba72e5d868f7ab6356c739e867b87f37c21
    Size: 7.61 MB
  8. npm-6.14.15-1.14.18.2.2.module+el8+1390+aa748c28.x86_64.rpm
    MD5: a660e06e98a61760dd0f47a5d071c726
    SHA-256: 035d6d110098384b9cee72ab8df2a419142eeffd9c6572d24ece8b4bd5d59c50
    Size: 3.68 MB