Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.2566
rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update
29 July 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-33502 CVE-2021-27290 CVE-2021-23362
CVE-2021-22918
Reference: ESB-2021.2555
ESB-2021.2408
ESB-2021.2329
ESB-2021.2315
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:2931
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update
Advisory ID: RHSA-2021:2931-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2021:2931
Issue date: 2021-07-28
CVE Names: CVE-2021-22918 CVE-2021-23362 CVE-2021-27290
CVE-2021-33502
=====================================================================
1. Summary:
An update for rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon is now
available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch, ppc64le, s390x, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64
3. Description:
Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version:
rh-nodejs12-nodejs (12.22.2).
Security Fix(es):
* nodejs-hosted-git-info: Regular Expression denial of service via
shortcutMatch in fromUrl() (CVE-2021-23362)
* nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in
strict mode (CVE-2021-27290)
* normalize-url: ReDoS for data URLs (CVE-2021-33502)
* libuv: out-of-bounds read in uv__idna_toascii() can lead to information
disclosures or crashes (CVE-2021-22918)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* ECDHE ciphers missing in rh-nodejs12 (BZ#1942592)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1941471 - CVE-2021-27290 nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode
1942592 - ECDHE ciphers missing in rh-nodejs12 [rhscl-3.6.z]
1943208 - CVE-2021-23362 nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()
1964461 - CVE-2021-33502 normalize-url: ReDoS for data URLs
1979338 - CVE-2021-22918 libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes
6. Package List:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source:
rh-nodejs12-nodejs-12.22.2-1.el7.src.rpm
rh-nodejs12-nodejs-nodemon-2.0.3-2.el7.src.rpm
noarch:
rh-nodejs12-nodejs-docs-12.22.2-1.el7.noarch.rpm
rh-nodejs12-nodejs-nodemon-2.0.3-2.el7.noarch.rpm
ppc64le:
rh-nodejs12-nodejs-12.22.2-1.el7.ppc64le.rpm
rh-nodejs12-nodejs-debuginfo-12.22.2-1.el7.ppc64le.rpm
rh-nodejs12-nodejs-devel-12.22.2-1.el7.ppc64le.rpm
rh-nodejs12-npm-6.14.13-12.22.2.1.el7.ppc64le.rpm
s390x:
rh-nodejs12-nodejs-12.22.2-1.el7.s390x.rpm
rh-nodejs12-nodejs-debuginfo-12.22.2-1.el7.s390x.rpm
rh-nodejs12-nodejs-devel-12.22.2-1.el7.s390x.rpm
rh-nodejs12-npm-6.14.13-12.22.2.1.el7.s390x.rpm
x86_64:
rh-nodejs12-nodejs-12.22.2-1.el7.x86_64.rpm
rh-nodejs12-nodejs-debuginfo-12.22.2-1.el7.x86_64.rpm
rh-nodejs12-nodejs-devel-12.22.2-1.el7.x86_64.rpm
rh-nodejs12-npm-6.14.13-12.22.2.1.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7):
Source:
rh-nodejs12-nodejs-12.22.2-1.el7.src.rpm
rh-nodejs12-nodejs-nodemon-2.0.3-2.el7.src.rpm
noarch:
rh-nodejs12-nodejs-docs-12.22.2-1.el7.noarch.rpm
rh-nodejs12-nodejs-nodemon-2.0.3-2.el7.noarch.rpm
ppc64le:
rh-nodejs12-nodejs-12.22.2-1.el7.ppc64le.rpm
rh-nodejs12-nodejs-debuginfo-12.22.2-1.el7.ppc64le.rpm
rh-nodejs12-nodejs-devel-12.22.2-1.el7.ppc64le.rpm
rh-nodejs12-npm-6.14.13-12.22.2.1.el7.ppc64le.rpm
s390x:
rh-nodejs12-nodejs-12.22.2-1.el7.s390x.rpm
rh-nodejs12-nodejs-debuginfo-12.22.2-1.el7.s390x.rpm
rh-nodejs12-nodejs-devel-12.22.2-1.el7.s390x.rpm
rh-nodejs12-npm-6.14.13-12.22.2.1.el7.s390x.rpm
x86_64:
rh-nodejs12-nodejs-12.22.2-1.el7.x86_64.rpm
rh-nodejs12-nodejs-debuginfo-12.22.2-1.el7.x86_64.rpm
rh-nodejs12-nodejs-devel-12.22.2-1.el7.x86_64.rpm
rh-nodejs12-npm-6.14.13-12.22.2.1.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source:
rh-nodejs12-nodejs-12.22.2-1.el7.src.rpm
rh-nodejs12-nodejs-nodemon-2.0.3-2.el7.src.rpm
noarch:
rh-nodejs12-nodejs-docs-12.22.2-1.el7.noarch.rpm
rh-nodejs12-nodejs-nodemon-2.0.3-2.el7.noarch.rpm
x86_64:
rh-nodejs12-nodejs-12.22.2-1.el7.x86_64.rpm
rh-nodejs12-nodejs-debuginfo-12.22.2-1.el7.x86_64.rpm
rh-nodejs12-nodejs-devel-12.22.2-1.el7.x86_64.rpm
rh-nodejs12-npm-6.14.13-12.22.2.1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-22918
https://access.redhat.com/security/cve/CVE-2021-23362
https://access.redhat.com/security/cve/CVE-2021-27290
https://access.redhat.com/security/cve/CVE-2021-33502
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYQEWP9zjgjWX9erEAQg0IA/+MpqOHy+/2+3+VZX6N4RAKpha+MHKjACV
/z2/8Dg4n8kiCdOD9babfz9aMXkLXv6UsdPhFve/vo3SC8xrnIozbVo9I/ZqoXWX
tECZSWLRh1l/A2KLffh1HePuQNo6AqMIOro0Tw27lERzq+FqGChaxuhkXVTUYCgW
U42eGH9/Ze3qzzHK1fH/Q5PHEwlGO2DS2G0OxLFizjxmgY8FyiavCoRr+SlZ6lWA
ErLL5tLkV7G9J9pRJd/LPC1yiur7GE9b4aXJ3RCYmGO703jYtNhF9QnWDtvORv9B
og/OZK33Jy6ANsyHolmZIbk5VpnxlUjyIe2xdYCcVsDjHpnTRCN1tHGgzSIGg18H
JiEr/3J5mlk6DL7hogeC2sS0P8GDnMBBS1iVFuKB1J+LExAn0WKxfi5SIwIQLhwZ
84LLfPywiInbFhxPPflEyqTjPHNGm1j2hcebOdrTkPVK09QDHUiIXOh4MacQW0qr
rH/1n1kQl33qa2zpXa6I+xh55l0TNK/kRSeBTtU8QsPhr7WMh+wTpwxy2s7o1unV
GwyVnOZbH4wwD9lrLZOsJh0QA3V9Fbd9YBw3IslD/kouii7sbDFgYIGJQW9QlwsZ
KOvcaX28Oshcy41ryj221Aof4nsN5EmF2va8apV7s4OWmceFBpg2yYqzcZA/kIMm
7LjinUudLwI=
=5qcy
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYQH/buNLKJtyKPYoAQhg8BAAmf3nyWFbYmamzRCXA7dD/Cm4htsU80n4
7ji9vSKfh51DrGLV7tHCIoSHAh9E+bXLSuok9WlhFggK5sZsjyWveSJ0r3ehtfiT
sITwd7RbZRv0Nvx6AojLFNV7NkfCXhh9kPtbt07Mc+faC9CnW3m+pbyss9jEQiTO
E2jcgFnlC5RdcbzU+xFxQGtgDK83PDkPkRuZm6WzIGgGQk1E38diQjIei7MFmkPv
NKGWY22Rt7Vwr9W1l2BPhXq6K+FxcQxb7ldiQ4FpCE6YgMpriwG1080Z0yzGVuIC
+t7I6DToFEdElb6L3SQj900IZ13Sp8uNjwxWpzzkFcZnYl0NFCKFSAWJoLNNSMzb
Sns/wuSNaZdrhMMrdgmAmB+tmBobUweAdkJjvPRePXvjyY9MbS3U/Hve+0zt7ynv
GlL4hpunAgptyxmt1v3JCWzYaETnwfEwTsM91kCPpa1Z19vEhZ8g08mzyrhzACqv
ZqQqrbnYVrDtH+0tOa3deoqN8Cc3d0oruyCkM8LShCWa0nrdqXWSe7LfRnSsdSHy
zSIVVtVLTpjn2gM6DlIBoW8+hHnv+JrKYZvYjj1v07+Gs7xR7KrM9Xr2JzXc1NYY
7yt9lpn8eYjWXv8AbCngR0wNROI1aPW6kYGiQFKR0LkD6ydkKRQrBtBD81KP9R8q
vY82dxSsF+I=
=XoqV
-----END PGP SIGNATURE-----