Rocky Linux 9 : nodejs and nodejs-nodemon (RLSA-2023:2655)

high Nessus Plugin ID 176395

Synopsis

The remote Rocky Linux host is missing one or more security updates.

Description

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:2655 advisory.

- This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library. (CVE-2022-25881)

- A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

- A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy. (CVE-2023-23918)

- An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
(CVE-2023-23920)

- Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
(CVE-2023-23936)

- Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available. (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 176395

File Name: rocky_linux_RLSA-2023-2655.nasl

Version: 1.1

Type: local

Family: Rocky Linux Local Security Checks

Published: 5/25/2023

Updated: 5/25/2023

Supported Sensors: Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C

CVSS Score Source: CVE-2022-4904

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:rocky:linux:nodejs-docs, p-cpe:/a:rocky:linux:nodejs-libs-debuginfo, p-cpe:/a:rocky:linux:nodejs, p-cpe:/a:rocky:linux:nodejs-nodemon, p-cpe:/a:rocky:linux:nodejs-full-i18n, p-cpe:/a:rocky:linux:nodejs-libs, p-cpe:/a:rocky:linux:nodejs-debugsource, cpe:/o:rocky:linux:9, p-cpe:/a:rocky:linux:npm, p-cpe:/a:rocky:linux:nodejs-debuginfo

Required KB Items: Host/local_checks_enabled, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/25/2023

Vulnerability Publication Date: 1/31/2023

Reference Information

CVE: CVE-2022-25881, CVE-2022-4904, CVE-2023-23918, CVE-2023-23920, CVE-2023-23936, CVE-2023-24807

Detections

Analytics