{"id":113646,"date":"2024-02-16T22:02:41","date_gmt":"2024-02-16T20:02:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-node-js-i-libuv"},"modified":"2024-02-16T22:02:41","modified_gmt":"2024-02-16T20:02:41","slug":"uyazvimosti-v-node-js-i-libuv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-node-js-i-libuv","title":{"rendered":"Turvahaavad Node.js-is ja libuv-s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Saadaval on parandavad versioonid JavaScript-serveri platvormist Node.js 21.6.2, 20.11.1, 18.19.1, milles on parandatud 8 haavatavust, millest 4 on k\u00f5rge ohutasemega:    <\/p>\n<ul>\n<li class=\"l\"> CVE-2024-21892 \u2014 v\u00f5imalus privileege omamata kasutaja poolt koodi sisestamiseks, millel on laiemad \u00f5igused, millega t\u00f6\u00f6protsess teostatakse. Haavatavus tuleneb veast erandite rakendamisel, mis v\u00f5imaldab keskkonnamuutujate t\u00f6\u00f6tlemist laiaulatuslike \u00f5igustega, kui need on seatud privileege omamata kasutaja poolt. Erand pidi olema antud ainult CAP_NET_BIND_SERVICE \u00f5iguste jaoks, kuid veate t\u00f5ttu kehtis see ka m\u00f5nele teisele \u00f5igusele (capabilities).\n<li class=\"l\"> CVE-2024-22019 \u2014 teenuse k\u00e4ttesaamatuks muutmine, kui ressursid (CPU koormus ja ribalaiuse tarbimine) on ammendatud, t\u00f6\u00f6tlemisel sisseehitatud HTTP-serveriga spetsiaalselt vormindatud chunked-p\u00e4ringute kaudu, mis toovad kaasa piiramatute baitide lugemise \u00fches \u00fchenduses.\n<li class=\"l\"> CVE-2024-21896 \u2014 p\u00f5hikausta \u00fcletamine failiteedes. Haavatavus v\u00f5imaldab m\u00f6\u00f6da minna failiteede normaliseerimisest, kasutades path.resolve(), kui teed edastatakse Buffer klassi kaudu. Selle tee saamiseks p\u00e4rast kontrollimist kutsutakse v\u00e4lja meetod Buffer.from(), kuid rakenduses v\u00f5ib kasutada Buffer.prototype.utf8Write, mis toob kaasa sisu muutmise path.resolve() t\u00e4itmise j\u00e4rgselt ja haavatavuse tekkimise.\n<li class=\"l\"> CVE-2024-22017 \u2014 setuid() kutsumisest ei t\u00fchistatud k\u00f5iki \u00f5igusi. Eriti m\u00f5jutas setuid() io_uring operatsioone, mida kasutatakse libuv-s, kui need on initsialiseeritud enne setuid() kutsumist.\n<li class=\"l\"> CVE-2023-46809 \u2014 haavatavus privateDecrypt() API-s, mis v\u00f5imaldab Marvin r\u00fcnnaku rakendamist RSA dekr\u00fcpteerimiseks, p\u00f5hinedes operatsioonide aja m\u00f5\u00f5tmisele.\n<li class=\"l\"> CVE-2024-21891 \u2014 v\u00f5imalus p\u00e4\u00e4seda m\u00f6\u00f6da juurdep\u00e4\u00e4su mudelist, kasutades kohandatud failiteede normaliseerimise t\u00f6\u00f6tlejat.\n<li class=\"l\"> CVE-2024-21890 \u2014 vale maskide t\u00f6\u00f6tlemine parameetrites \u2018\u2014allow-fs-read\u2019 ja \u2018\u2014allow-fs-write\u2019. N\u00e4iteks \u2018\u2014allow-fs-read=\/home\/node\/.ssh\/*.pub\u2019 annab juurdep\u00e4\u00e4su kogu \u2018.ssh\/\u2019 kausta sisule, mitte ainult \u2018.pub\u2019 laiendiga failidele, kuna mask \u2018*\u2019 t\u00f6\u00f6deldakse tee viimase elemendina.\n<li class=\"l\"> CVE-2024-22025 \u2014 teenuse k\u00e4ttesaamatuks muutmine, kui ressursid on ammendatud Brotli formaadis tihendatud andmete dekodeerimisel, mis saadakse fetch() meetodi kaudu.          <\/ul>\n<p>Lisaks v\u00f5ib m\u00e4rkida, et on ilmunud libuv 1.48.0 versioon, mida kasutatakse Node.js-is \u00fchenduste multiplexerimise ja as\u00fcnkroonse I\/O t\u00f6\u00f6tlemise jaoks. Lisaks kasutab seda raamatukogu ka DNS-serverid BIND 9 ja Knot DNS, HTTP-server H2O, Lua-raamistik Luvit.  <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/vps\/abuzoustojchivye-vps\/\"   title=\"virtuaalses masinas\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4302\">virtuaalses masinas<\/a> MoarVM, Julia keel ja Python raamistik uvloop. Uues versioonis on k\u00f5rvaldatud haavatavus (CVE-2024-24806), mis ilmneb projektides, mis kasutavad libuv ja v\u00f5imaldab SSRF (Server-side request forgery) r\u00fcnnakut sisemise API juurde p\u00e4\u00e4semiseks. Haavatavus tekkis, kuna uv_getaddrinfo() funktsioon k\u00e4rpis hosti nime 256 t\u00e4hem\u00e4rgi piiranguni enne domeeni lahendamist getaddrinfo() kaudu, mis v\u00f5ib viia vale m\u00e4\u00e4ratlemiseni ja kontrollide \u00fcmbers\u00f5iduni. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/lir\/ipv4\/\"   title=\"IP-aadressid\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"665\">IP-aadressid<\/a> ja kontrollide ringk\u00e4igust. N\u00e4iteks teenused nagu MySpace, mis loovad alamdomeene kujul &#171;username.example.com&#187;, v\u00f5ivad olla r\u00fcnnakuobjektiks, kui kasutada pikka kasutajanime.      <\/p>\n<p>Samuti ilmus uuendus Node.js-i HTTP-klientidele undici 5.28.3, kus k\u00f5rvaldatud haavatavus (CVE-2024-24758) tulenes HTTP-pealkirja Proxy-Authorization puhastamise puudumisest taotluste v\u00f5imaliku \u00fcmbersuunamise ajal.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60612\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 JavaScript-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Node.js 21.6.2, 20.11.1, 18.19.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 4 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: CVE-2024-21892 &#8212; \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u0434\u0430, \u043d\u0430\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c. \u0418\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113646","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 JavaScript-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Node.js 21.6.2, 20.11.1, 18.19.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 4 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: CVE-2024-21892 -.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-node-js-i-libuv\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Node.js \u0438 libuv | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 JavaScript-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Node.js 21.6.2, 20.11.1, 18.19.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 4 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: CVE-2024-21892 -.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-node-js-i-libuv\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-02-16T20:02:41+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-02-16T20:02:41+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Node.js ja libuv haavatavused | ProHoster","description":"Saadaval on paranduste v\u00e4ljaanded Node.js serverip\u00f5hises JavaScripti platvormis versioonides 21.6.2, 20.11.1, 18.19.1, kus on parandatud 8 haavatavust, millest 4 on k\u00f5rge ohut\u00f5en\u00e4osusega: CVE-2024-21892.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-node-js-i-libuv","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Node.js \u0438 libuv | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 JavaScript-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Node.js 21.6.2, 20.11.1, 18.19.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 4 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: CVE-2024-21892 -.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-node-js-i-libuv","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-16T20:02:41+00:00","article:modified_time":"2024-02-16T20:02:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113646","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:23:59","updated":"2026-02-08 20:23:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=113646"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113646\/revisions"}],"predecessor-version":[{"id":164177,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113646\/revisions\/164177"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=113646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=113646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=113646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}