Amazon Linux 2023 Security Advisory: ALAS-2024-766
Advisory Release Date: 2024-11-13 12:28 Pacific
Advisory Updated Date: 2024-11-14 11:00 Pacific
Severity:
Medium
Issue Overview:
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders. (CVE-2024-28863)
Affected Packages:
nodejs
Issue Correction:
Run dnf update nodejs --releasever 2023.6.20241111 to update your system.
New Packages:
aarch64:
nodejs-debuginfo-18.20.4-1.amzn2023.0.1.aarch64
nodejs-full-i18n-18.20.4-1.amzn2023.0.1.aarch64
nodejs-libs-debuginfo-18.20.4-1.amzn2023.0.1.aarch64
nodejs-devel-18.20.4-1.amzn2023.0.1.aarch64
v8-10.2-devel-10.2.154.26-1.18.20.4.1.amzn2023.0.1.aarch64
nodejs-libs-18.20.4-1.amzn2023.0.1.aarch64
nodejs-18.20.4-1.amzn2023.0.1.aarch64
nodejs-npm-10.7.0-1.18.20.4.1.amzn2023.0.1.aarch64
nodejs-debugsource-18.20.4-1.amzn2023.0.1.aarch64
noarch:
nodejs-docs-18.20.4-1.amzn2023.0.1.noarch
src:
nodejs-18.20.4-1.amzn2023.0.1.src
x86_64:
nodejs-libs-debuginfo-18.20.4-1.amzn2023.0.1.x86_64
nodejs-debuginfo-18.20.4-1.amzn2023.0.1.x86_64
v8-10.2-devel-10.2.154.26-1.18.20.4.1.amzn2023.0.1.x86_64
nodejs-devel-18.20.4-1.amzn2023.0.1.x86_64
nodejs-full-i18n-18.20.4-1.amzn2023.0.1.x86_64
nodejs-18.20.4-1.amzn2023.0.1.x86_64
nodejs-libs-18.20.4-1.amzn2023.0.1.x86_64
nodejs-npm-10.7.0-1.18.20.4.1.amzn2023.0.1.x86_64
nodejs-debugsource-18.20.4-1.amzn2023.0.1.x86_64