The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1583 advisory.

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  - Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  - Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

  - Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  - Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  - Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : nodejs:18 (RHSA-2023:1583)

high Nessus Plugin ID 189668

Version 1.1

Version 1.0

Version 1.1 Apr 23, 2024, 11:13 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202404232313
Version 1.0 Jan 26, 2024, 11:18 PM New Plugin Feed: 202401262318