RHSA-2024:1503HighCVSS 8.1

Red Hat Security Advisory: nodejs:18 security update

Published
March 25, 2024
Last Modified
August 13, 2026

🔗 CVE IDs covered (3)

CVE-2023-46809 →CVE-2024-21892 →CVE-2024-22019 →

📋 Description

CVE-2023-46809 — nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) CVE-2024-21892 — nodejs: code injection and privilege escalation through Linux capabilities CVE-2024-22019 — nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

🎯 Affected products32

  • Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:18.19.1-1.module+el9.3.0+21388+22892fb9.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:18.19.1-1.module+el9.3.0+21388+22892fb9.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:18.19.1-1.module+el9.3.0+21388+22892fb9.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:18.19.1-1.module+el9.3.0+21388+22892fb9.src (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:18.19.1-1.module+el9.3.0+21388+22892fb9.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:18.19.1-1.module+el9.3.0+21388+22892fb9.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:18.19.1-1.module+el9.3.0+21388+22892fb9.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:18.19.1-1.module+el9.3.0+21388+22892fb9.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:18.19.1-1.module+el9.3.0+21388+22892fb9.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:18.19.1-1.module+el9.3.0+21388+22892fb9.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:18.19.1-1.module+el9.3.0+21388+22892fb9.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:18.19.1-1.module+el9.3.0+21388+22892fb9.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:18.19.1-1.module+el9.3.0+21388+22892fb9.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:18.19.1-1.module+el9.3.0+21388+22892fb9.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:18.19.1-1.module+el9.3.0+21388+22892fb9.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:18.19.1-1.module+el9.3.0+21388+22892fb9.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:18.19.1-1.module+el9.3.0+21388+22892fb9.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-docs-1:18.19.1-1.module+el9.3.0+21388+22892fb9.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:18.19.1-1.module+el9.3.0+21388+22892fb9.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:18.19.1-1.module+el9.3.0+21388+22892fb9.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:18.19.1-1.module+el9.3.0+21388+22892fb9.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:18.19.1-1.module+el9.3.0+21388+22892fb9.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-nodemon-0:3.0.1-1.module+el9.3.0+19762+d716bf3b.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-nodemon-0:3.0.1-1.module+el9.3.0+19762+d716bf3b.src (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-packaging-0:2021.06-4.module+el9.1.0+15718+e52ec601.src (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-packaging-bundler-0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • npm-1:10.2.4-1.18.19.1.1.module+el9.3.0+21388+22892fb9.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • npm-1:10.2.4-1.18.19.1.1.module+el9.3.0+21388+22892fb9.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +2 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (3)