Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Node.js 18 on Red Hat systems exposed to security risk

published 2 years ago

Summary

An update is available for Node.js 18 on Red Hat systems. This update addresses a security issue that could allow an attacker to execute arbitrary code on the affected system. Users are advised to install the update to prevent potential security risks.

What to do

Update redhat nodejs to version 1:18.20.4-1.module+el9.4.0+22195+c221878e.
Update redhat nodejs-debuginfo to version 1:18.20.4-1.module+el9.4.0+22195+c221878e.
Update redhat nodejs-debugsource to version 1:18.20.4-1.module+el9.4.0+22195+c221878e.
Update redhat nodejs-devel to version 1:18.20.4-1.module+el9.4.0+22195+c221878e.
Update redhat nodejs-docs to version 1:18.20.4-1.module+el9.4.0+22195+c221878e.
Update redhat nodejs-full-i18n to version 1:18.20.4-1.module+el9.4.0+22195+c221878e.
Update redhat nodejs-nodemon to version 0:3.0.1-1.module+el9.3.0+19762+d716bf3b.
Update redhat nodejs-packaging to version 0:2021.06-4.module+el9.1.0+15718+e52ec601.
Update redhat nodejs-packaging-bundler to version 0:2021.06-4.module+el9.1.0+15718+e52ec601.
Update redhat npm to version 1:10.7.0-1.18.20.4.1.module+el9.4.0+22195+c221878e.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:9::appstream	redhat	nodejs	< 1:18.20.4-1.module+el9.4.0+22195+c221878e Fix: upgrade to 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream	redhat	nodejs-debuginfo	< 1:18.20.4-1.module+el9.4.0+22195+c221878e Fix: upgrade to 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream	redhat	nodejs-debugsource	< 1:18.20.4-1.module+el9.4.0+22195+c221878e Fix: upgrade to 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream	redhat	nodejs-devel	< 1:18.20.4-1.module+el9.4.0+22195+c221878e Fix: upgrade to 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream	redhat	nodejs-docs	< 1:18.20.4-1.module+el9.4.0+22195+c221878e Fix: upgrade to 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream	redhat	nodejs-full-i18n	< 1:18.20.4-1.module+el9.4.0+22195+c221878e Fix: upgrade to 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream	redhat	nodejs-nodemon	< 0:3.0.1-1.module+el9.3.0+19762+d716bf3b Fix: upgrade to 0:3.0.1-1.module+el9.3.0+19762+d716bf3b
Red Hat:enterprise_linux:9::appstream	redhat	nodejs-packaging	< 0:2021.06-4.module+el9.1.0+15718+e52ec601 Fix: upgrade to 0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:enterprise_linux:9::appstream	redhat	nodejs-packaging-bundler	< 0:2021.06-4.module+el9.1.0+15718+e52ec601 Fix: upgrade to 0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:enterprise_linux:9::appstream	redhat	npm	< 1:10.7.0-1.18.20.4.1.module+el9.4.0+22195+c221878e Fix: upgrade to 1:10.7.0-1.18.20.4.1.module+el9.4.0+22195+c221878e

Original advisory text

Red Hat Security Advisory: nodejs:18 security update

References

https://access.redhat.com/errata/RHSA-2024:6147 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2293200 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2296417 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6147.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-22020 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-22020 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-22020 Vendor Advisory
https://hackerone.com/reports/2092749 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-28863 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-28863 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-28863 Vendor Advisory
https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36 Third Party Advisory
https://security.netapp.com/advisory/ntap-20240524-0005/ Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Timeline

Published22 Oct 2024

Updated6 Mar 2026

First seen6 Mar 2026

Sources

RHSA-2024:6147 · OSV

Track software like this

Free during beta