Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Node.js 16 on Red Hat Systems Can Be Exploited Remotely

published 2 years ago

Summary

A security update is available for Node.js 16 on Red Hat systems. This update fixes a vulnerability that could allow an attacker to execute arbitrary code on a system if they can upload and run a malicious Node.js script. It's recommended to update your systems to the latest version of Node.js 16 to prevent potential security risks.

What to do

Update redhat nodejs to version 1:16.14.0-4.module+el8.6.0+15294+54b291d2.
Update redhat nodejs-debuginfo to version 1:16.14.0-4.module+el8.6.0+15294+54b291d2.
Update redhat nodejs-debugsource to version 1:16.14.0-4.module+el8.6.0+15294+54b291d2.
Update redhat nodejs-devel to version 1:16.14.0-4.module+el8.6.0+15294+54b291d2.
Update redhat nodejs-docs to version 1:16.14.0-4.module+el8.6.0+15294+54b291d2.
Update redhat nodejs-full-i18n to version 1:16.14.0-4.module+el8.6.0+15294+54b291d2.
Update redhat nodejs-nodemon to version 0:2.0.15-1.module+el8.6.0+15294+54b291d2.
Update redhat nodejs-packaging to version 0:25-1.module+el8.5.0+10992+fac5fe06.
Update redhat npm to version 1:8.3.1-1.16.14.0.4.module+el8.6.0+15294+54b291d2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::appstream	redhat	nodejs	< 1:16.14.0-4.module+el8.6.0+15294+54b291d2 Fix: upgrade to 1:16.14.0-4.module+el8.6.0+15294+54b291d2
Red Hat:enterprise_linux:8::appstream	redhat	nodejs-debuginfo	< 1:16.14.0-4.module+el8.6.0+15294+54b291d2 Fix: upgrade to 1:16.14.0-4.module+el8.6.0+15294+54b291d2
Red Hat:enterprise_linux:8::appstream	redhat	nodejs-debugsource	< 1:16.14.0-4.module+el8.6.0+15294+54b291d2 Fix: upgrade to 1:16.14.0-4.module+el8.6.0+15294+54b291d2
Red Hat:enterprise_linux:8::appstream	redhat	nodejs-devel	< 1:16.14.0-4.module+el8.6.0+15294+54b291d2 Fix: upgrade to 1:16.14.0-4.module+el8.6.0+15294+54b291d2
Red Hat:enterprise_linux:8::appstream	redhat	nodejs-docs	< 1:16.14.0-4.module+el8.6.0+15294+54b291d2 Fix: upgrade to 1:16.14.0-4.module+el8.6.0+15294+54b291d2
Red Hat:enterprise_linux:8::appstream	redhat	nodejs-full-i18n	< 1:16.14.0-4.module+el8.6.0+15294+54b291d2 Fix: upgrade to 1:16.14.0-4.module+el8.6.0+15294+54b291d2
Red Hat:enterprise_linux:8::appstream	redhat	nodejs-nodemon	< 0:2.0.15-1.module+el8.6.0+15294+54b291d2 Fix: upgrade to 0:2.0.15-1.module+el8.6.0+15294+54b291d2
Red Hat:enterprise_linux:8::appstream	redhat	nodejs-packaging	< 0:25-1.module+el8.5.0+10992+fac5fe06 Fix: upgrade to 0:25-1.module+el8.5.0+10992+fac5fe06
Red Hat:enterprise_linux:8::appstream	redhat	npm	< 1:8.3.1-1.16.14.0.4.module+el8.6.0+15294+54b291d2 Fix: upgrade to 1:8.3.1-1.16.14.0.4.module+el8.6.0+15294+54b291d2

Original advisory text

Red Hat Security Advisory: nodejs:16 security update

References

https://access.redhat.com/errata/RHSA-2022:4796 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2050282 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4796.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-43616 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-43616 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-43616 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

8.1 High

Timeline

Published14 Sep 2024

Updated4 Jul 2026

First seen4 Jul 2026

Sources

RHSA-2022:4796 · OSV

Track software like this

Free during beta