171 lines
13 KiB
XML
171 lines
13 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
|
<DocumentTitle xml:lang="en">An update for nodejs is now available for openEuler-20.03-LTS and openEuler-20.03-LTS-SP1</DocumentTitle>
|
|
<DocumentType>Security Advisory</DocumentType>
|
|
<DocumentPublisher Type="Vendor">
|
|
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
|
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
|
</DocumentPublisher>
|
|
<DocumentTracking>
|
|
<Identification>
|
|
<ID>openEuler-SA-2021-1114</ID>
|
|
</Identification>
|
|
<Status>Final</Status>
|
|
<Version>1.0</Version>
|
|
<RevisionHistory>
|
|
<Revision>
|
|
<Number>1.0</Number>
|
|
<Date>2021-04-07</Date>
|
|
<Description>Initial</Description>
|
|
</Revision>
|
|
</RevisionHistory>
|
|
<InitialReleaseDate>2021-04-07</InitialReleaseDate>
|
|
<CurrentReleaseDate>2021-04-07</CurrentReleaseDate>
|
|
<Generator>
|
|
<Engine>openEuler SA Tool V1.0</Engine>
|
|
<Date>2021-04-07</Date>
|
|
</Generator>
|
|
</DocumentTracking>
|
|
<DocumentNotes>
|
|
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">nodejs security update</Note>
|
|
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for nodejs is now available for openEuler-20.03-LTS and openEuler-20.03-LTS-SP1.</Note>
|
|
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.
|
|
|
|
Security Fix(es):
|
|
|
|
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.(CVE-2021-22883)
|
|
|
|
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.(CVE-2021-22884)</Note>
|
|
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for nodejs is now available for openEuler-20.03-LTS and openEuler-20.03-LTS-SP1.
|
|
|
|
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
|
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">High</Note>
|
|
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">nodejs</Note>
|
|
</DocumentNotes>
|
|
<DocumentReferences>
|
|
<Reference Type="Self">
|
|
<URL>https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1114</URL>
|
|
</Reference>
|
|
<Reference Type="openEuler CVE">
|
|
<URL>https://openeuler.org/en/security/cve/detail.html?id=CVE-2021-22883</URL>
|
|
<URL>https://openeuler.org/en/security/cve/detail.html?id=CVE-2021-22884</URL>
|
|
</Reference>
|
|
<Reference Type="Other">
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2021-22883</URL>
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2021-22884</URL>
|
|
</Reference>
|
|
</DocumentReferences>
|
|
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
|
<Branch Type="Product Name" Name="openEuler">
|
|
<FullProductName ProductID="openEuler-20.03-LTS" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">openEuler-20.03-LTS</FullProductName>
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="aarch64">
|
|
<FullProductName ProductID="npm-6.14.4-1.10.21.0.6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">npm-6.14.4-1.10.21.0.6.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-libs-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-libs-10.21.0-6.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-debugsource-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-debugsource-10.21.0-6.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-full-i18n-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-full-i18n-10.21.0-6.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-10.21.0-6.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-debuginfo-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-debuginfo-10.21.0-6.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-devel-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-devel-10.21.0-6.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="v8-devel-6.8.275.32-1.10.21.0.6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">v8-devel-6.8.275.32-1.10.21.0.6.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="npm-6.14.4-1.10.21.0.7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">npm-6.14.4-1.10.21.0.7.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-debuginfo-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-debuginfo-10.21.0-7.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="v8-devel-6.8.275.32-1.10.21.0.7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">v8-devel-6.8.275.32-1.10.21.0.7.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-full-i18n-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-full-i18n-10.21.0-7.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-devel-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-devel-10.21.0-7.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-10.21.0-7.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-debugsource-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-debugsource-10.21.0-7.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-libs-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-libs-10.21.0-7.oe1.aarch64.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="noarch">
|
|
<FullProductName ProductID="nodejs-docs-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-docs-10.21.0-6.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-docs-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-docs-10.21.0-7.oe1.noarch.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="src">
|
|
<FullProductName ProductID="nodejs-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-10.21.0-6.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-10.21.0-7.oe1.src.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="x86_64">
|
|
<FullProductName ProductID="v8-devel-6.8.275.32-1.10.21.0.6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">v8-devel-6.8.275.32-1.10.21.0.6.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-full-i18n-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-full-i18n-10.21.0-6.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-10.21.0-6.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-debugsource-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-debugsource-10.21.0-6.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-libs-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-libs-10.21.0-6.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-devel-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-devel-10.21.0-6.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-debuginfo-10.21.0-6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">nodejs-debuginfo-10.21.0-6.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="npm-6.14.4-1.10.21.0.6" CPE="cpe:/a:openEuler:openEuler:20.03-LTS">npm-6.14.4-1.10.21.0.6.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-libs-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-libs-10.21.0-7.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-debugsource-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-debugsource-10.21.0-7.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-debuginfo-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-debuginfo-10.21.0-7.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-full-i18n-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-full-i18n-10.21.0-7.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-devel-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-devel-10.21.0-7.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="v8-devel-6.8.275.32-1.10.21.0.7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">v8-devel-6.8.275.32-1.10.21.0.7.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="npm-6.14.4-1.10.21.0.7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">npm-6.14.4-1.10.21.0.7.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="nodejs-10.21.0-7" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">nodejs-10.21.0-7.oe1.x86_64.rpm</FullProductName>
|
|
</Branch>
|
|
</ProductTree>
|
|
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2021-04-07</ReleaseDate>
|
|
<CVE>CVE-2021-22883</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>High</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>7.5</BaseScore>
|
|
<Vector>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>nodejs security update</Description>
|
|
<DATE>2021-04-07</DATE>
|
|
<URL>https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1114</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
<Vulnerability Ordinal="2" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="2" xml:lang="en">Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2021-04-07</ReleaseDate>
|
|
<CVE>CVE-2021-22884</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>High</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>7.5</BaseScore>
|
|
<Vector>AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>nodejs security update</Description>
|
|
<DATE>2021-04-07</DATE>
|
|
<URL>https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1114</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
</cvrfdoc>
|