RHSA-2023:1744HighCVSS 8.6

Red Hat Security Advisory: rh-nodejs14-nodejs security, bug fix, and enhancement update

Published
April 12, 2023
Last Modified
August 13, 2026

🔗 CVE IDs covered (5)

CVE-2023-23918 →CVE-2023-23920 →CVE-2022-4904 →CVE-2022-25881 →CVE-2022-38900 →

📋 Description

CVE-2022-4904 — c-ares: buffer overflow in config_sortlist() due to missing string length check CVE-2022-25881 — http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability CVE-2022-38900 — decode-uri-component: improper input validation resulting in DoS CVE-2023-23918 — Node.js: Permissions policies can be bypassed via process.mainModule CVE-2023-23920 — Node.js: insecure loading of ICU data through ICU_DATA environment variable

🎯 Affected products40

  • Red Hat Software Collections for RHEL Workstation(v. 7)
  • Red Hat Software Collections for RHEL(v. 7)
  • rh-nodejs14-0:3.6-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-0:3.6-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-0:3.6-2.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-0:3.6-2.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)
  • rh-nodejs14-0:3.6-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-0:3.6-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)
  • rh-nodejs14-nodejs-0:14.21.3-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-0:14.21.3-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-0:14.21.3-2.el7.src as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-0:14.21.3-2.el7.src as a component of Red Hat Software Collections for RHEL(v. 7)
  • rh-nodejs14-nodejs-0:14.21.3-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-0:14.21.3-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)
  • rh-nodejs14-nodejs-debuginfo-0:14.21.3-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-debuginfo-0:14.21.3-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-debuginfo-0:14.21.3-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-debuginfo-0:14.21.3-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)
  • rh-nodejs14-nodejs-devel-0:14.21.3-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-devel-0:14.21.3-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-devel-0:14.21.3-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-devel-0:14.21.3-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)
  • rh-nodejs14-nodejs-docs-0:14.21.3-2.el7.noarch as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-docs-0:14.21.3-2.el7.noarch as a component of Red Hat Software Collections for RHEL(v. 7)
  • rh-nodejs14-nodejs-full-i18n-0:14.21.3-2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-full-i18n-0:14.21.3-2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-full-i18n-0:14.21.3-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-nodejs-full-i18n-0:14.21.3-2.el7.x86_64 as a component of Red Hat Software Collections for RHEL(v. 7)
  • rh-nodejs14-npm-0:6.14.18-14.21.3.2.el7.ppc64le as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • rh-nodejs14-npm-0:6.14.18-14.21.3.2.el7.s390x as a component of Red Hat Software Collections for RHEL Workstation(v. 7)
  • +10 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Turn off the --experimental-policy in your Node.js deployment.

🔗 References (9)