CVE-2022-24999
Description
Moderate: nodejs:14 security, bug fix, and enhancement update
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2023-0050.html
Vendor advisory: alma — https://bugzilla.redhat.com/2150323
Vendor advisory: alma — https://bugzilla.redhat.com/2140911
Vendor advisory: alma — https://bugzilla.redhat.com/2134609
Vendor advisory: alma — https://bugzilla.redhat.com/2066009
Vendor advisory: alma — https://bugzilla.redhat.com/2044591
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2023:0050
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2022-24999
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2023:0050
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rocky | 8 | fixed | |
| debian | bookworm | fixed | 6.10.3+ds+~6.9.7-1 |
| debian | bullseye | fixed | 6.9.4+ds-1+deb11u1 |
| debian | forky | fixed | 6.10.3+ds+~6.9.7-1 |
| debian | sid | fixed | 6.10.3+ds+~6.9.7-1 |
| debian | trixie | fixed | 6.10.3+ds+~6.9.7-1 |
References
- https://errata.rockylinux.org/RLSA-2023:0050
- https://nvd.nist.gov/vuln/detail/CVE-2022-24999
- https://github.com/ljharb/qs/pull/428
- https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec
- https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68
- https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b
- https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d
- https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1
- https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105
- https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f
- https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee
- https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda
- https://github.com/expressjs/express/releases/tag/4.17.3
- https://github.com/ljharb/qs
- https://github.com/n8tz/CVE-2022-24999
- https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html
- https://security.netapp.com/advisory/ntap-20230908-0005
- https://security-tracker.debian.org/tracker/CVE-2022-24999
- https://access.redhat.com/errata/RHSA-2023:0050
- https://bugzilla.redhat.com/2044591
- https://bugzilla.redhat.com/2066009
- https://bugzilla.redhat.com/2134609
- https://bugzilla.redhat.com/2140911
- https://bugzilla.redhat.com/2150323
- https://errata.almalinux.org/8/ALSA-2023-0050.html
Verify integrity in audit chain (admin only). AS-IS.