{"id":113646,"date":"2024-02-16T22:02:41","date_gmt":"2024-02-16T20:02:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-node-js-i-libuv"},"modified":"2024-02-16T22:02:41","modified_gmt":"2024-02-16T20:02:41","slug":"uyazvimosti-v-node-js-i-libuv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-node-js-i-libuv","title":{"rendered":"Vulnerabilities in Node.js and libuv","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases for the server-side JavaScript platform Node.js 21.6.2, 20.11.1, 18.19.1 are available, which fix 8 vulnerabilities, 4 of which have been assigned a high severity level: <\/p>\n
\n
CVE-2024-21892 \u2014 the ability for an unprivileged user to inject code that inherits elevated privileges under which the process runs. The vulnerability is caused by an exception handling error that allows environment variables set by unprivileged users to be processed in a privileged context. The exception was meant to be granted only for CAP_NET_BIND_SERVICE permissions but mistakenly applied to some other capabilities.\n
CVE-2024-22019 \u2014 denial of service through resource exhaustion (CPU load and bandwidth consumption) when processing specially crafted chunked requests by the built-in HTTP server, leading to unbounded byte reading in a single connection.\n
CVE-2024-21896 \u2014 directory traversal in file paths. This vulnerability allows bypassing file path normalization using path.resolve() when passing a path with the Buffer class. A method Buffer.from() is called after verification to obtain such a path, but the application may use Buffer.prototype.utf8Write, leading to content replacement after executing path.resolve() and creating a vulnerability.\n
CVE-2024-22017 \u2014 calling setuid() did not drop all privileges. Specifically, setuid() does not affect io_uring operations used in libuv if they were initialized before the setuid() call.\n
CVE-2023-46809 \u2014 vulnerability in the privateDecrypt() API allowing for a Marvin attack to decrypt RSA based on timing measurements.\n
CVE-2024-21891 \u2014 the ability to bypass the access control model when using custom file path normalization handlers.\n
CVE-2024-21890 \u2014 incorrect handling of masks in the parameters \u2018--allow-fs-read\u2019 and \u2018--allow-fs-write\u2019. For instance, \u2018--allow-fs-read=\/home\/node\/.ssh\/*.pub\u2019 will grant access to all contents of \u2018.ssh\/\u2019 instead of only files with the \u2018.pub\u2019 extension, as the mask \u2018*\u2019 is processed as the last element of the path.\n
CVE-2024-22025 \u2014 denial of service through resource exhaustion when decoding compressed Brotli data obtained via a fetch() call. <\/ul>\n