nodejs:18 security update
エラータID: AXSA:2024-7654:01
リリース日:
2024/04/04 Thursday - 16:21
題名:
nodejs:18 security update
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Node.js には、特定の機能を利用のうえ、対象のプロセスを特権に
昇格して実行する際、本来評価すべき特権を持たない利用者によって
設定された環境変数を無視してしまう問題があるため、ローカルの
攻撃者により、特権で実行できる任意のコードの挿入を可能とする
脆弱性が存在します。(CVE-2024-21892)
- Node.js の HTTP サーバー機能には、チャンク拡張データサイズを
制限する処理が欠落しており、単一のコネクションから制限なくデータ
を読み取ってしまう問題があるため、リモートの攻撃者により、巧妙に
細工された HTTP リクエストの送信を介して、サービス拒否攻撃 (CPU
リソースおよびネットワーク帯域の枯渇) を可能とする脆弱性が存在
します。(CVE-2024-22019)
現時点では下記の CVE の情報が公開されておりません。
CVE の情報が公開され次第情報をアップデートいたします。
CVE-2023-46809
Modularity name: nodejs
Stream name: 18
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2023-46809
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2024-21892
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
CVE-2024-22019
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-3.0.1-1.module+el8+1738+98cd3fa8.src.rpm
MD5: 3d843e0808deab5cd8afbd889fb34c5e
SHA-256: e4be53e288937b2c96c59ef181f4f701ea201c3c4f5fc492ce2dc530a1e10fb2
Size: 340.68 kB - nodejs-packaging-2021.06-4.module+el8+1738+98cd3fa8.src.rpm
MD5: e87074197b01e9fe3b7f9f52cfc3d342
SHA-256: 80f242ef3ff0c0987d1603d7aaf92d8e88626c97e040b41307b12d3d7bfac656
Size: 30.29 kB - nodejs-18.19.1-1.module+el8+1738+98cd3fa8.src.rpm
MD5: b9f2d7d07e06ccf51a83a12d89b9a7a3
SHA-256: 4d716317ddb18049e5e60373eb717346506507b604ff0abb384f0299a27d9e67
Size: 123.59 MB
Asianux Server 8 for x86_64
- nodejs-18.19.1-1.module+el8+1738+98cd3fa8.x86_64.rpm
MD5: b9c1dec6449265777ec11ffc57ded8dd
SHA-256: fc8fa4e622f9222f8bf3ede84cbab8fd57ff173f7209ef0831fef9af901ef6cb
Size: 13.62 MB - nodejs-debugsource-18.19.1-1.module+el8+1738+98cd3fa8.x86_64.rpm
MD5: 7ee6c326085deae5cf34304664690bb1
SHA-256: af3f95a00c96f1d8be8857c76de6e8fdc6563a3b7cb071b59e5086b73fdc90f3
Size: 14.32 MB - nodejs-devel-18.19.1-1.module+el8+1738+98cd3fa8.x86_64.rpm
MD5: 94576b96acc9348050ce3d7aa62c0f30
SHA-256: b1e54c77b576fdf007034abd14ea9e4b43b35a5061f3626737403cf0ffbd87a2
Size: 207.41 kB - nodejs-docs-18.19.1-1.module+el8+1738+98cd3fa8.noarch.rpm
MD5: d55117f49ca6a78e91d79ef2dd27764c
SHA-256: e3652c11695b9261b40208ffd981823976add497f7dac9ae08978f0f2a042cd7
Size: 10.15 MB - nodejs-full-i18n-18.19.1-1.module+el8+1738+98cd3fa8.x86_64.rpm
MD5: b20bb47c12ea509eb8231a4d1cd8aabf
SHA-256: 662adb116bff19c4ad513265f896f8262ac6ff79c5e5df1efeda540dd4ac876a
Size: 8.25 MB - nodejs-nodemon-3.0.1-1.module+el8+1738+98cd3fa8.noarch.rpm
MD5: 150d221b1bc6717a9058e17820901a16
SHA-256: f70814c54801602dc107e1a0aacfb4b94927717717cf4c43358d829bbcb6324d
Size: 282.09 kB - nodejs-packaging-2021.06-4.module+el8+1738+98cd3fa8.noarch.rpm
MD5: b03d13aa474481deba66e74176cc45ba
SHA-256: 2603cf2d0748210650c94f4a0eb945e0a15353a1e0a125a15a94d0cae3764a81
Size: 24.14 kB - nodejs-packaging-bundler-2021.06-4.module+el8+1738+98cd3fa8.noarch.rpm
MD5: d4d5d68270c1794882c57993f23c8c17
SHA-256: dc9c2197420cd7a4f3f060e625319b36ee56aee5b9e892b8fe9a38192fe970a4
Size: 13.76 kB - npm-10.2.4-1.18.19.1.1.module+el8+1738+98cd3fa8.x86_64.rpm
MD5: 1597a7bcd0cc1ceba62878da1a6c3e21
SHA-256: c7287f5cae44da35b3b8ee513897415a938872ef6d0345dddd6f9d5430624d3b
Size: 2.12 MB
English