Arch Linux alert ASA-202107-32 (nodejs-lts-fermium)
| From: | Jonas Witschel via arch-security <arch-security@lists.archlinux.org> | |
| To: | arch-security@lists.archlinux.org | |
| Subject: | [ASA-202107-32] nodejs-lts-fermium: multiple issues | |
| Date: | Tue, 20 Jul 2021 21:29:16 +0200 | |
| Message-ID: | <20210720192916.7egd4m2jnogrpkct@archlinux.org> | |
| Cc: | Jonas Witschel <diabonas@archlinux.org> |
Arch Linux Security Advisory ASA-202107-32 ========================================== Severity: High Date : 2021-07-20 CVE-ID : CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 Package : nodejs-lts-fermium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2127 Summary ======= The package nodejs-lts-fermium before version 14.17.3-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 14.17.3-1. # pacman -Syu "nodejs-lts-fermium>=14.17.3-1" The problems have been fixed upstream in version 14.17.3. Workaround ========== None. Description =========== - CVE-2021-22918 (information disclosure) libuv before version 1.14.1, as bundled by Node.js before versions 16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. - CVE-2021-23362 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. - CVE-2021-27290 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. Impact ====== A remote attacker could disclose information by supplying crafted domain names, or cause denial of service through high resource usage with crafted Git repository URLs or Subresource Integrity (SRI) hashes. References ========== https://github.com/libuv/libuv/issues/3147 https://hackerone.com/reports/1209681 https://github.com/libuv/libuv/commit/86dbeb4bd665749d623... https://nodejs.org/en/blog/vulnerability/july-2021-securi... https://github.com/nodejs/node/commit/d33aead28bcec32a2a4... https://github.com/nodejs/node/commit/a7496aba0a95b6425e9... https://github.com/nodejs/node/commit/623fd1fcb557985bf45... https://nodejs.org/en/blog/vulnerability/july-2021-securi... https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 https://github.com/npm/hosted-git-info/pull/76 https://github.com/npm/hosted-git-info/commit/bede0dc38e1... https://nodejs.org/en/blog/vulnerability/july-2021-securi... https://github.com/advisories/GHSA-vx3p-948g-6vhq https://doyensec.com/resources/Doyensec_Advisory_ssri_red... https://github.com/npm/ssri/pull/17 https://github.com/npm/ssri/commit/76e223317d971f19e4db81... https://security.archlinux.org/CVE-2021-22918 https://security.archlinux.org/CVE-2021-23362 https://security.archlinux.org/CVE-2021-27290