nodejs:16 security, bug fix, and enhancement update
エラータID: AXSA:2022-4547:01
リリース日:
2022/12/27 Tuesday - 06:07
題名:
nodejs:16 security, bug fix, and enhancement update
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- nodejs には、名前が制約された中間証明書をバイパス
してしまう問題があるため、リモートの攻撃者により、
不正な証明書の検証を可能とする脆弱性が存在します。
(CVE-2021-44531)
- nodejs には、サブジェクト代替名の文字列表現形式に
インジェクションをもたらす問題があるため、リモートの
攻撃者により、巧妙に細工されたサブジェクト代替名を持つ
証明書を介して、不正な証明書の検証を可能とする脆弱性が
存在します。(CVE-2021-44532)
- nodejs には、多値の相対識別名を正しく扱えない問題が
あるため、リモートの攻撃者により、巧妙に細工された
サブジェクトを持つ証明書を介して、不正な証明書の検証を
可能とする脆弱性が存在します。(CVE-2021-44533)
- Minimist の index.js ファイルの setKey 関数には、
リモートの攻撃者により、プロトタイプの汚染を可能とする
脆弱性が存在します。(CVE-2021-44906)
- nodejs の console.table() には、書式設定ロジックに
問題があるため、プロトタイプ汚染攻撃を可能とする
脆弱性が存在します。(CVE-2022-21824)
- nodejs の minimatch パッケージには、特定の引数による
braceExpand 関数の呼び出しを介して、正規表現による
サービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2022-3517)
- nodejs の IsAllowedHost 関数には IP アドレスが
無効化かどうかを正しく検証しない問題があるため、
リモートの攻撃者による DNS リバインド攻撃を可能とする
脆弱性が存在します。(CVE-2022-43548)
Modularity name: nodejs
Stream name: 16
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2021-44531
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44532
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44533
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
CVE-2021-44906
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVE-2022-21824
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
CVE-2022-3517
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
CVE-2022-43548
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-2.0.20-2.module+el8+1578+4f40001e.src.rpm
MD5: 7d584f53e2f1808ce1ee4024d8416fe8
SHA-256: 2a54c9fc92464ca2adf11d10ed90b9e94835598d0a585df924be8de0696f3da3
Size: 393.97 kB - nodejs-packaging-25-1.module+el8+1578+4f40001e.src.rpm
MD5: 3ddf2f0acac11a82631ad5133f8b57ed
SHA-256: 495492e8fc72b329ce1e7a40505ecbe8d82078ba7decf17117e7f0966d1c1266
Size: 26.80 kB - nodejs-16.18.1-3.module+el8+1578+4f40001e.src.rpm
MD5: 39a08fcbca4ee5b590c6c68017b75fd8
SHA-256: 8510228ac51e921e5c9fb34ce99c052c403f48fa1d7b84c43b84ddb92a099fab
Size: 70.55 MB
Asianux Server 8 for x86_64
- nodejs-nodemon-2.0.20-2.module+el8+1578+4f40001e.noarch.rpm
MD5: a8621f9e9623651b2abe96297d986eef
SHA-256: cbd656e02a9fce96f8c8fcdc2a7f73b2461130fa794dabef6d2b3e5c90df7499
Size: 272.44 kB - nodejs-packaging-25-1.module+el8+1578+4f40001e.noarch.rpm
MD5: 902d3eee655d2d92e033bfea08c4f074
SHA-256: 5000115587b873e40b170abdfc8846633239602e4c547084b3c7a157a2cc246d
Size: 23.19 kB - nodejs-16.18.1-3.module+el8+1578+4f40001e.x86_64.rpm
MD5: b708395c15657c92513c29c4072a19f3
SHA-256: 0500d3eb54750416559ca24ec5fc67972d8c225fac4803cf44a0fa9dea9d8973
Size: 12.23 MB - nodejs-debugsource-16.18.1-3.module+el8+1578+4f40001e.x86_64.rpm
MD5: 00d3347bed991f73d4b8fa229c46c688
SHA-256: b8fd81a68f167441989ab0f19614053b480e4e1d4f0820f9dfb4d2955a5eda2e
Size: 12.99 MB - nodejs-devel-16.18.1-3.module+el8+1578+4f40001e.x86_64.rpm
MD5: c63cb8dd3c0b64a7b97b98a043885d27
SHA-256: bcfc4a700c7c41fa45470550735bf2539b31f5d64457a9bd3fbcaf51cbeb2ee7
Size: 191.69 kB - nodejs-docs-16.18.1-3.module+el8+1578+4f40001e.noarch.rpm
MD5: 10116145486d5b5fd9c8550caaa83e8f
SHA-256: 1f4ff02da737092b14d49a39494d993b8217e7e4a6334e47c442f55cb812ca76
Size: 9.33 MB - nodejs-full-i18n-16.18.1-3.module+el8+1578+4f40001e.x86_64.rpm
MD5: a25326aa286c63dc39d0e5021824de28
SHA-256: 42a3492bfd63321f35825de65ec990db068cc43ecbe4cefbe653d94223032808
Size: 8.01 MB - npm-8.19.2-1.16.18.1.3.module+el8+1578+4f40001e.x86_64.rpm
MD5: 2d9b9c3eb6427180eeffb3f394cda841
SHA-256: 3cf6aac79178c795ce80f501f7e8b43186721a32ccb62e86b818b5d746597dc4
Size: 1.96 MB
English