SB20230821190 - Fedora 37 update for nodejs16, nodejs18, nodejs20

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32002)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions for the Module._load() method. A remote attacker can bypass the policy mechanism and include modules outside of the policy.json definition for a given module.

2) Path traversal (CVE-ID: CVE-2023-32003)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to a missing check in the fs.mkdtemp() API. A remote attacker can bypass the permission model check using a path traversal attack in fs.mkdtemp() and fs.mkdtempSync().

3) Path traversal (CVE-ID: CVE-2023-32004)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to improper handling of Buffers in file system APIs. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32005)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an inadequate permission model that fails to restrict file stats through the fs.statfs API. A remote user can retrieve stats from files that they do not have explicit read access to.

5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32006)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions for the module.constructor.createRequire() method. A remote attacker can bypass the policy mechanism and include modules outside of the policy.json definition for a given module.

6) Path traversal (CVE-ID: CVE-2023-32558)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the deprecated API process.binding(). A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32559)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to usage of deprecated API process.binding(). A remote attacker can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2023-18476abd7e