An update for nodejs is now available for openEuler-20.03-LTS and openEuler-20.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2021-1114 Final 1.0 1.0 2021-04-07 Initial 2021-04-07 2021-04-07 openEuler SA Tool V1.0 2021-04-07 nodejs security update An update for nodejs is now available for openEuler-20.03-LTS and openEuler-20.03-LTS-SP1. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.(CVE-2021-22883) Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.(CVE-2021-22884) An update for nodejs is now available for openEuler-20.03-LTS and openEuler-20.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High nodejs https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1114 https://openeuler.org/en/security/cve/detail.html?id=CVE-2021-22883 https://openeuler.org/en/security/cve/detail.html?id=CVE-2021-22884 https://nvd.nist.gov/vuln/detail/CVE-2021-22883 https://nvd.nist.gov/vuln/detail/CVE-2021-22884 openEuler-20.03-LTS openEuler-20.03-LTS-SP1 npm-6.14.4-1.10.21.0.6.oe1.aarch64.rpm nodejs-libs-10.21.0-6.oe1.aarch64.rpm nodejs-debugsource-10.21.0-6.oe1.aarch64.rpm nodejs-full-i18n-10.21.0-6.oe1.aarch64.rpm nodejs-10.21.0-6.oe1.aarch64.rpm nodejs-debuginfo-10.21.0-6.oe1.aarch64.rpm nodejs-devel-10.21.0-6.oe1.aarch64.rpm v8-devel-6.8.275.32-1.10.21.0.6.oe1.aarch64.rpm npm-6.14.4-1.10.21.0.7.oe1.aarch64.rpm nodejs-debuginfo-10.21.0-7.oe1.aarch64.rpm v8-devel-6.8.275.32-1.10.21.0.7.oe1.aarch64.rpm nodejs-full-i18n-10.21.0-7.oe1.aarch64.rpm nodejs-devel-10.21.0-7.oe1.aarch64.rpm nodejs-10.21.0-7.oe1.aarch64.rpm nodejs-debugsource-10.21.0-7.oe1.aarch64.rpm nodejs-libs-10.21.0-7.oe1.aarch64.rpm nodejs-docs-10.21.0-6.oe1.noarch.rpm nodejs-docs-10.21.0-7.oe1.noarch.rpm nodejs-10.21.0-6.oe1.src.rpm nodejs-10.21.0-7.oe1.src.rpm v8-devel-6.8.275.32-1.10.21.0.6.oe1.x86_64.rpm nodejs-full-i18n-10.21.0-6.oe1.x86_64.rpm nodejs-10.21.0-6.oe1.x86_64.rpm nodejs-debugsource-10.21.0-6.oe1.x86_64.rpm nodejs-libs-10.21.0-6.oe1.x86_64.rpm nodejs-devel-10.21.0-6.oe1.x86_64.rpm nodejs-debuginfo-10.21.0-6.oe1.x86_64.rpm npm-6.14.4-1.10.21.0.6.oe1.x86_64.rpm nodejs-libs-10.21.0-7.oe1.x86_64.rpm nodejs-debugsource-10.21.0-7.oe1.x86_64.rpm nodejs-debuginfo-10.21.0-7.oe1.x86_64.rpm nodejs-full-i18n-10.21.0-7.oe1.x86_64.rpm nodejs-devel-10.21.0-7.oe1.x86_64.rpm v8-devel-6.8.275.32-1.10.21.0.7.oe1.x86_64.rpm npm-6.14.4-1.10.21.0.7.oe1.x86_64.rpm nodejs-10.21.0-7.oe1.x86_64.rpm Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory. 2021-04-07 CVE-2021-22883 openEuler-20.03-LTS openEuler-20.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H nodejs security update 2021-04-07 https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1114 Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160. 2021-04-07 CVE-2021-22884 openEuler-20.03-LTS openEuler-20.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H nodejs security update 2021-04-07 https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1114