CVE-2022-35255
Description
RHSA-2022:7821: nodejs:18 security update (Important)
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Description nodejs: weak randomness in WebCrypto keygen Red Hat statement The vulnerability was introduced in NodeJS v15.0.0, Hence, NodeJS:14 package in RHEL-8 and RHSCL-3 are not affected. CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Errata / fixed releases ProductPackageAdvisoryReleased Red Hat Enterprise Linux…
Description
nodejs: weak randomness in WebCrypto keygen
Red Hat statement
The vulnerability was introduced in NodeJS v15.0.0, Hence, NodeJS:14 package in RHEL-8 and RHSCL-3 are not affected.
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | nodejs:16-8060020221007164523.ad008a3a | RHSA-2022:6964 | 2022-10-17T00:00:00Z |
| Red Hat Enterprise Linux 8 | nodejs:18-8070020221004121421.bd1311ed | RHSA-2022:7821 | 2022-11-08T00:00:00Z |
| Red Hat Enterprise Linux 9 | nodejs-1:16.17.1-1.el9_0 | RHSA-2022:6963 | 2022-10-18T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 8 | nodejs:14/nodejs | Not affected |
| Red Hat Enterprise Linux 9 | nodejs:18/nodejs | Not affected |
| Red Hat Software Collections | rh-nodejs14-nodejs | Not affected |
Apply commands
yum update -y nodejs:16
# or:
dnf upgrade -y nodejs:16Affected
| Vendor | Product | Version |
|---|---|---|
| redhat | Red Hat Enterprise Linux 8 | Not affected |
| redhat | Red Hat Enterprise Linux 9 | Not affected |
| redhat | Red Hat Software Collections | Not affected |
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| rocky | 8 | fixed | |
| sles | affected | | |
| rocky | 9 | fixed | |
| debian | bookworm | fixed | 18.10.0+dfsg-1 |
| debian | bullseye | fixed | 12.22.12~dfsg-1~deb11u3 |
| debian | forky | fixed | 18.10.0+dfsg-1 |
| debian | sid | fixed | 18.10.0+dfsg-1 |
| debian | trixie | fixed | 18.10.0+dfsg-1 |
| almalinux | 9 | fixed | nodejs-docs-16.17.1-1.el9_0.noarch.rpm |
| almalinux | 8 | fixed | nodejs-16.17.1-1.module_el8.6.0+3328+2e4711d7.aarch64.rpm |
| rhel | 8 | fixed | |
References
- https://access.redhat.com/errata/RHSA-2022:6963
- https://errata.rockylinux.org/RLSA-2022:7821
- https://www.suse.com/security/cve/CVE-2022-35255.html
- https://errata.rockylinux.org/RLSA-2022:6964
- https://errata.rockylinux.org/RLSA-2022:6963
- https://security-tracker.debian.org/tracker/CVE-2022-35255
- https://access.redhat.com/errata/RHSA-2022:7821
- https://bugzilla.redhat.com/2130517
- https://bugzilla.redhat.com/2130518
- https://errata.almalinux.org/8/ALSA-2022-7821.html
- https://access.redhat.com/errata/RHSA-2022:6964
- https://errata.almalinux.org/8/ALSA-2022-6964.html
- https://errata.almalinux.org/9/ALSA-2022-6963.html
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.