-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: rh-nodejs14-nodejs security update Advisory ID: RHSA-2023:4039-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2023:4039 Issue date: 2023-07-12 CVE Names: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067 ===================================================================== 1. Summary: An update for rh-nodejs14-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for RHEL Workstation(v. 7) - noarch, ppc64le, s390x, x86_64 Red Hat Software Collections for RHEL(v. 7) - noarch, x86_64 3. Description: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067) * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130) * c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147) * c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2209494 - CVE-2023-31124 c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation 2209497 - CVE-2023-31130 c-ares: Buffer Underwrite in ares_inet_net_pton() 2209501 - CVE-2023-31147 c-ares: Insufficient randomness in generation of DNS query IDs 2209502 - CVE-2023-32067 c-ares: 0-byte UDP payload Denial of Service 6. Package List: Red Hat Software Collections for RHEL Workstation(v. 7): Source: rh-nodejs14-nodejs-14.21.3-4.el7.src.rpm noarch: rh-nodejs14-nodejs-docs-14.21.3-4.el7.noarch.rpm ppc64le: rh-nodejs14-nodejs-14.21.3-4.el7.ppc64le.rpm rh-nodejs14-nodejs-debuginfo-14.21.3-4.el7.ppc64le.rpm rh-nodejs14-nodejs-devel-14.21.3-4.el7.ppc64le.rpm rh-nodejs14-nodejs-full-i18n-14.21.3-4.el7.ppc64le.rpm rh-nodejs14-npm-6.14.18-14.21.3.4.el7.ppc64le.rpm s390x: rh-nodejs14-nodejs-14.21.3-4.el7.s390x.rpm rh-nodejs14-nodejs-debuginfo-14.21.3-4.el7.s390x.rpm rh-nodejs14-nodejs-devel-14.21.3-4.el7.s390x.rpm rh-nodejs14-nodejs-full-i18n-14.21.3-4.el7.s390x.rpm rh-nodejs14-npm-6.14.18-14.21.3.4.el7.s390x.rpm x86_64: rh-nodejs14-nodejs-14.21.3-4.el7.x86_64.rpm rh-nodejs14-nodejs-debuginfo-14.21.3-4.el7.x86_64.rpm rh-nodejs14-nodejs-devel-14.21.3-4.el7.x86_64.rpm rh-nodejs14-nodejs-full-i18n-14.21.3-4.el7.x86_64.rpm rh-nodejs14-npm-6.14.18-14.21.3.4.el7.x86_64.rpm Red Hat Software Collections for RHEL(v. 7): Source: rh-nodejs14-nodejs-14.21.3-4.el7.src.rpm noarch: rh-nodejs14-nodejs-docs-14.21.3-4.el7.noarch.rpm x86_64: rh-nodejs14-nodejs-14.21.3-4.el7.x86_64.rpm rh-nodejs14-nodejs-debuginfo-14.21.3-4.el7.x86_64.rpm rh-nodejs14-nodejs-devel-14.21.3-4.el7.x86_64.rpm rh-nodejs14-nodejs-full-i18n-14.21.3-4.el7.x86_64.rpm rh-nodejs14-npm-6.14.18-14.21.3.4.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2023-31124 https://access.redhat.com/security/cve/CVE-2023-31130 https://access.redhat.com/security/cve/CVE-2023-31147 https://access.redhat.com/security/cve/CVE-2023-32067 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJkrqzNAAoJENzjgjWX9erESuAP/ibSBdF1DR/I/vUgD2OqpvaH evULtjwOdp31vlestbl+DM3DrhyUb1fbscYHSVwK+PHC0nHlhUmSUghjLKQS2JU/ udMBSUbDfLw950fGcS3lp/DT5sAvchPXQy2GYjOdjwZVJAsE52ecetzdd3G2xc+0 cNn0XcRuSPFtkS47sPkeZdlHd17RDy2fgIHsTrJ9wm4lO7az3pqNqSegrLpIVbXr Y+S+I+yVmlasQ9/l6BUG3JTp5zsQpItWF8DkXvPrv59saLRLo+Vz8ursOjWW0ihE DnMg0hznfknP0FmEr1o70AcEzhSBSvA0X4qlUttORdhoaN8KLtaXjNiMVMke4asw prvDiJCoPO7y2pZFIw2oRt0d92/xZRE5T6t0UhGw1hejMPPKP7tcTsTpzoGtWHw3 VzgD322B7I6hSqJP1q18Q1bG2m7hm4QtxTSF+557VjBFMpqPSiKDRkUnb7CigJuz wgaKN2IP1iTeIOpjZpnBa0EiPszUmSN+FxSqo/1BchQSGomaONWk5XJtVYSO4ZYm Uo4qiM6p1EE5jMuBgkHwml5uY4EAemyHfGWobyjrylF4aGYZ11iYJayTIcZktmzC bTT3Mwdj4d2l+fgyf7s38tA5hgpD3fgdF9TH+FTtEJUmJucBF47P/A01v5RypfAC wcnuYaT1q7Bg8mySBCqN =FTmv -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce