nodejs:14 security and bug fix update
エラータID: AXSA:2021-1568:01
リリース日:
2021/03/10 Wednesday - 01:59
題名:
nodejs:14 security and bug fix update
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Node.js には 'unknownProtocol' での接続の扱いに問題があり、ファイルディスクリプタを
適切に解放しないため、ファイルディスクリプタ上限が設定されている場合は
ファイルディスクリプタが枯渇して新しい接続を受け付けられない、もしくはファイルを
開けなくなる現象が発生し、ファイルディスクリプタ上限が設定されていない場合は
メモリの枯渇を引き起こすサービス妨害(DoS)の脆弱性があります。(CVE-2021-22883)
- Node.js はホワイトリストに "localhost6" を含んでおり、攻撃者が被害者の
DNS サーバーを制御しているか、もしくは DNS レスポンスをスプーフィングできる場合、
"localhost6" ドメインを使って DNS リバインディング保護機構をバイパスできるため、
攻撃者が"localhost6"ドメインを使用している限り、CVE-2018-7160に記載されている攻撃を
行うことのできる脆弱性があります。(CVE-2021-22884)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2021-22883
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
CVE-2021-22884
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-2.0.3-1.module+el8+1221+618c6279.src.rpm
MD5: a8fadfbffaf473a135ab264fa5c3109d
SHA-256: 6b93ca19cbc837a5348462aa6f7e07f1154af919d9578189258e870295982518
Size: 1.15 MB - nodejs-packaging-23-3.module+el8+1221+618c6279.src.rpm
MD5: 810a7ecae3681b6677b45a40c0eb23f6
SHA-256: 44b3d93ddd488e6506d1358abdb7ccb050ac2e561555b216c8a025d1915e1adf
Size: 26.56 kB - nodejs-14.16.0-2.module+el8+1221+618c6279.src.rpm
MD5: 7639d09c674f3b59e14fc722f490984c
SHA-256: e15c43ff02f48450a2c3bd473dccfe582c9d778d40b7c7fa52c99032da9809f6
Size: 65.30 MB
Asianux Server 8 for x86_64
- nodejs-nodemon-2.0.3-1.module+el8+1221+618c6279.noarch.rpm
MD5: 57d76d0f0b0142e38fc387f0746b739c
SHA-256: 507547e5316831e04e85fad64436c07c29630363d7408969536ca1672fb04d30
Size: 806.99 kB - nodejs-packaging-23-3.module+el8+1221+618c6279.noarch.rpm
MD5: 4f6841d14f3797af2b36c98b0c9bc775
SHA-256: bb69d1e8b228569b521400b49ac99a45f25a6eca456aa058a9c916cef8ab3fb9
Size: 23.02 kB - nodejs-14.16.0-2.module+el8+1221+618c6279.x86_64.rpm
MD5: d2968e03dbdc69bd98a03a3dfa0dcd99
SHA-256: ab1117b4016cc468a298d3d1c4f959c5cc568ca2456b7111f877909e3b30f44a
Size: 10.61 MB - nodejs-debugsource-14.16.0-2.module+el8+1221+618c6279.x86_64.rpm
MD5: cd8604c34e55b29564b9870a43ae4873
SHA-256: 3604f9fe028c16c8be9019ba4d23db7cd1751c6ceb6efe1f62be4ec1510d2401
Size: 10.78 MB - nodejs-devel-14.16.0-2.module+el8+1221+618c6279.x86_64.rpm
MD5: 4d76170264857d84a8e1e7dab6582c4a
SHA-256: f601eb46f807a28b9e40201acf68dc11521cc2822c6d455e2305122821d14c5c
Size: 200.23 kB - nodejs-docs-14.16.0-2.module+el8+1221+618c6279.noarch.rpm
MD5: bf64c848507e6587cc1f7a77efa531b0
SHA-256: 2dc2d6ab56c4f727a4b471d55e89b10ad1098bbd726f06e3674131a65de1e798
Size: 7.92 MB - nodejs-full-i18n-14.16.0-2.module+el8+1221+618c6279.x86_64.rpm
MD5: 52189cd111032321f3ff1620f7d8e5ef
SHA-256: 8337d30894378c4a660f74e71aa1b948ae3a365f2fe4d89b2a5b274044557277
Size: 7.49 MB - npm-6.14.11-1.14.16.0.2.module+el8+1221+618c6279.x86_64.rpm
MD5: 5b0408f198a2668fec9e80a4125046f6
SHA-256: d71e41a64179909f5a182d9d33300ff3605089826bd7a06a93988f58f871fcc8
Size: 3.67 MB
English