Amazon Linux 2023 Security Advisory: ALAS-2023-243
Advisory Release Date: 2023-07-05 20:13 Pacific
Advisory Updated Date: 2023-07-20 00:56 Pacific
Severity:
Medium
Issue Overview:
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity. (CVE-2022-4904)
It is possible to bypass Permissions and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy (https://nodejs.org/api/permissions.html#policies). (CVE-2023-23918)
Affected Packages:
nodejs
Issue Correction:
Run dnf update nodejs --releasever 2023.1.20230719 to update your system.
New Packages:
aarch64:
nodejs-libs-debuginfo-18.12.1-1.amzn2023.0.6.aarch64
nodejs-full-i18n-18.12.1-1.amzn2023.0.6.aarch64
nodejs-debuginfo-18.12.1-1.amzn2023.0.6.aarch64
v8-devel-10.2.154.15-1.18.12.1.1.amzn2023.0.6.aarch64
nodejs-18.12.1-1.amzn2023.0.6.aarch64
nodejs-devel-18.12.1-1.amzn2023.0.6.aarch64
nodejs-libs-18.12.1-1.amzn2023.0.6.aarch64
npm-8.19.2-1.18.12.1.1.amzn2023.0.6.aarch64
nodejs-debugsource-18.12.1-1.amzn2023.0.6.aarch64
noarch:
nodejs-docs-18.12.1-1.amzn2023.0.6.noarch
src:
nodejs-18.12.1-1.amzn2023.0.6.src
x86_64:
nodejs-libs-debuginfo-18.12.1-1.amzn2023.0.6.x86_64
v8-devel-10.2.154.15-1.18.12.1.1.amzn2023.0.6.x86_64
nodejs-debuginfo-18.12.1-1.amzn2023.0.6.x86_64
nodejs-libs-18.12.1-1.amzn2023.0.6.x86_64
nodejs-devel-18.12.1-1.amzn2023.0.6.x86_64
nodejs-full-i18n-18.12.1-1.amzn2023.0.6.x86_64
nodejs-18.12.1-1.amzn2023.0.6.x86_64
npm-8.19.2-1.18.12.1.1.amzn2023.0.6.x86_64
nodejs-debugsource-18.12.1-1.amzn2023.0.6.x86_64