遠端 Redhat Enterprise Linux 9 主機上安裝的多個套件受到 RHSA-2024:3544 公告中提及的多個弱點影響。

    Node.js 是一個軟體開發平台，可使用 JavaScript 程式設計語言建置快速且可擴充的網路應用程式。

    安全性修正：

    *nodejs：CONTINUATION 框架 DoS (CVE-2024-27983)
    *nodejs：nghttp2：CONTINUATION 框架 DoS (CVE-2024-28182)

    如需安全性問題的詳細資料，包括影響、CVSS 分數、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的多個套件受到 RHSA-2024:4824 公告中提及的多個弱點影響。

    Node.js 是一個軟體開發平台，可使用 JavaScript 程式設計語言建置快速且可擴充的網路應用程式。

    安全性修正：

    * nghttp2：CONTINUATION 框架 DoS (CVE-2024-28182,VU#421644.5)

    * nodejs：CONTINUATION 框架 DoS (CVE-2024-27983)

    如需安全性問題的詳細資料，包括影響、CVSS 分數、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2779 advisory.

    nodejs     [1:18.20.2-2]
    - Removes .ps1 files
    - Rebase to 18.20.2
    - Fixes: CVE-2024-27983, CVE-2024-28182, CVE-2024-27982, CVE-2024-25629

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2853 advisory.

    - Backport nghttp2 patch for CVE-2024-28182

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3472 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * rh-nodejs14-nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3553 advisory.

    Node.js is a software development platform for building fast and scalable     network applications in the JavaScript programming language.

    Security Fix(es):

    * nodejs/16: CONTINUATION frames DoS (CVE-2024-27983)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nodejs18 / nodejs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27983 advisory.

  - An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2     frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after     reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is     abruptly closed by the client triggering the Http2Session destructor while header frames are still being     processed (and stored in memory) causing a race condition. (CVE-2024-27983)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1308-1 advisory.

  - The team has identified a vulnerability in the http server of the most recent version of Node, where     malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-     length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within     the body of the first. Impacts: Thank you, to bpingel for reporting this vulnerability and Paolo Insogna     for fixing it.  Summary The Node.js project will release new versions of the 18.x, 20.x, 21.x releases     lines on or shortly after, Wednesday, April 3, 2024 in order to address: (CVE-2024-27982)

  - An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2     frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after     reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is     abruptly closed by the client triggering the Http2Session destructor while header frames are still being     processed (and stored in memory) causing a race condition. (CVE-2024-27983)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1355-1 advisory.

  - The team has identified a vulnerability in the http server of the most recent version of Node, where     malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-     length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within     the body of the first. Impacts: Thank you, to bpingel for reporting this vulnerability and Paolo Insogna     for fixing it.  Summary The Node.js project will release new versions of the 18.x, 20.x, 21.x releases     lines on or shortly after, Wednesday, April 3, 2024 in order to address: (CVE-2024-27982)

  - An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2     frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after     reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is     abruptly closed by the client triggering the Http2Session destructor while header frames are still being     processed (and stored in memory) causing a race condition. (CVE-2024-27983)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2ffe03eaa6 advisory.

    ## 2024-04-03, Version 20.12.1 'Iron' (LTS), @RafaelGSS

    This is a security release

    ### Notable Changes

    * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::\~Http2Session() leads to HTTP/2 server     crash- (High)
    * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
    * llhttp version 9.2.1
    * undici version 5.28.4

    ### Commits

    * \[[`bd8f10a257`](https://github.com/nodejs/node/commit/bd8f10a257)] - **deps**: update undici to v5.28.4     (Matteo Collina) [nodejs-private/node-private#576](https://github.com/nodejs-private/node-     private/pull/576)
    * \[[`5e34540a96`](https://github.com/nodejs/node/commit/5e34540a96)] - **http**: do not allow OBS fold in     headers by default (Paolo Insogna) [nodejs-private/node-private#557](https://github.com/nodejs-     private/node-private/pull/557)
    * \[[`ba1ae6d188`](https://github.com/nodejs/node/commit/ba1ae6d188)] - **src**: ensure to close stream     when destroying session (Anna Henningsen) [nodejs-private/node-private#561](https://github.com/nodejs-     private/node-private/pull/561)

    ----

    ## 2024-04-03, Version 20.12.1 'Iron' (LTS), @RafaelGSS

    This is a security release

    ### Notable Changes

    * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::\~Http2Session() leads to HTTP/2 server     crash- (High)
    * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
    * llhttp version 9.2.1
    * undici version 5.28.4


    ----

    ## 2024-03-26, Version 20.12.0 'Iron' (LTS), @richardlau

    ### Notable Changes

    #### crypto: implement crypto.hash()

    This patch introduces a helper crypto.hash() that computes     a digest from the input at one shot. This can be 1.2-2x faster     than the object-based createHash() for smaller inputs (<= 5MB)     that are readily available (not streamed) and incur less memory     overhead since no intermediate objects will be created.

    ```js     const crypto = require('node:crypto');

    // Hashing a string and return the result as a hex-encoded string.
    const string = 'Node.js';
    // 10b3493287f831e81a438811a1ffba01f8cec4b7     console.log(crypto.hash('sha1', string));
    ```

    Contributed by Joyee Cheung in [#51044](https://github.com/nodejs/node/pull/51044).

    #### Loading and parsing environment variables

    * `process.loadEnvFile(path)`:
      * Use this function to load the `.env` file. If no path is specified, it automatically loads the .env     file in the current directory. Example: `process.loadEnvFile()`.
      * Load a specific .env file by specifying its path. Example: `process.loadEnvFile('./development.env')`.

    * `util.parseEnv(content)`:
      * Use this function to parse an existing string containing environment variable assignments.
      * Example usage: `require('node:util').parseEnv('HELLO=world')`.

    Contributed by Yagiz Nizipli in [#51476](https://github.com/nodejs/node/pull/51476).

    #### New connection attempt events

    Three new events were added in the `net.createConnection` flow:

    * `connectionAttempt`: Emitted when a new connection attempt is established. In case of Happy Eyeballs,     this might emitted multiple times.
    * `connectionAttemptFailed`: Emitted when a connection attempt failed. In case of Happy Eyeballs, this     might emitted multiple times.
    * `connectionAttemptTimeout`: Emitted when a connection attempt timed out. In case of Happy Eyeballs, this     will not be emitted for the last attempt. This is not emitted at all if Happy Eyeballs is not used.

    Additionally, a previous bug has been fixed where a new connection attempt could have been started after a     previous one failed and after the connection was destroyed by the user.
    This led to a failed assertion.

    Contributed by Paolo Insogna in [#51045](https://github.com/nodejs/node/pull/51045).

    #### Permission Model changes

    Node.js 20.12.0 comes with several fixes for the experimental permission model and two new semver-minor     commits.
    We're adding a new flag `--allow-addons` to enable addon usage when using the Permission Model.

    ```console     $ node --experimental-permission --allow-addons     ```

    Contributed by Rafael Gonzaga in [#51183](https://github.com/nodejs/node/pull/51183)

    And relative paths are now supported through the `--allow-fs-*` flags.
    Therefore, with this release one can use:

    ```console     $ node --experimental-permission --allow-fs-read=./index.js     ```

    To give only read access to the entrypoint of the application.

    Contributed by Rafael Gonzaga and Carlos Espa in [#50758](https://github.com/nodejs/node/pull/50758).

    #### sea: support embedding assets

    Users can now include assets by adding a key-path dictionary     to the configuration as the `assets` field. At build time, Node.js     would read the assets from the specified paths and bundle them into     the preparation blob. In the generated executable, users can retrieve     the assets using the `sea.getAsset()` and `sea.getAssetAsBlob()` API.

    ```json     {       main: /path/to/bundled/script.js,       output: /path/to/write/the/generated/blob.blob,       assets: {         a.jpg: /path/to/a.jpg,         b.txt: /path/to/b.txt       }     }     ```

    The single-executable application can access the assets as follows:

    ```cjs     const { getAsset } = require('node:sea');
    // Returns a copy of the data in an ArrayBuffer     const image = getAsset('a.jpg');
    // Returns a string decoded from the asset as UTF8.
    const text = getAsset('b.txt', 'utf8');
    // Returns a Blob containing the asset without copying.
    const blob = getAssetAsBlob('a.jpg');
    ```

    Contributed by Joyee Cheung in [#50960](https://github.com/nodejs/node/pull/50960).

    #### Support configurable snapshot through `--build-snapshot-config` flag

    We are adding a new flag `--build-snapshot-config` to configure snapshots through a custom JSON     configuration file.

    ```console     $ node --build-snapshot-config=/path/to/myconfig.json     ```

    When using this flag, additional script files provided on the command line will     not be executed and instead be interpreted as regular command line arguments.

    These changes were contributed by Joyee Cheung and Anna Henningsen in     [#50453](https://github.com/nodejs/node/pull/50453)

    #### Text Styling

    * `util.styleText(format, text)`: This function returns a formatted text considering the `format` passed.

    A new API has been created to format text based on `util.inspect.colors`, enabling you to style text in     different colors (such as red, blue, ...) and emphasis (italic, bold, ...).

    ```cjs     const { styleText } = require('node:util');
    const errorMessage = styleText('red', 'Error! Error!');
    console.log(errorMessage);
    ```

    Contributed by Rafael Gonzaga in [#51850](https://github.com/nodejs/node/pull/51850).

    #### vm: support using the default loader to handle dynamic import()

    This patch adds support for using `vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER` as the     `importModuleDynamically` option in all vm APIs that take this option except `vm.SourceTextModule`. This     allows users to have a shortcut to support dynamic `import()` in the compiled code without missing the     compilation cache if they don't need customization of the loading process. We emit an experimental warning     when the `import()` is actually handled by the default loader through this option instead of requiring     `--experimental-vm-modules`.

    ```js     const { Script, constants } = require('node:vm');
    const { resolve } = require('node:path');
    const { writeFileSync } = require('node:fs');

    // Write test.js and test.txt to the directory where the current script     // being run is located.
    writeFileSync(resolve(__dirname, 'test.mjs'),                   'export const filename = ./test.json;');
    writeFileSync(resolve(__dirname, 'test.json'),                   '{hello: world}');

    // Compile a script that loads test.mjs and then test.json     // as if the script is placed in the same directory.
    const script = new Script(       `(async function() {         const { filename } = await import('./test.mjs');
        return import(filename, { with: { type: 'json' } })       })();`,       {         filename: resolve(__dirname, 'test-with-default.js'),         importModuleDynamically: constants.USE_MAIN_CONTEXT_DEFAULT_LOADER,       });

    // { default: { hello: 'world' } }     script.runInThisContext().then(console.log);
    ```

    Contributed by Joyee Cheung in [#51244](https://github.com/nodejs/node/pull/51244).

    #### Root certificates updated to NSS 3.98

    Certificates added:

    * Telekom Security TLS ECC Root 2020
    * Telekom Security TLS RSA Root 2023

    Certificates removed:

    * Security Communication Root CA

    #### Updated dependencies

    * acorn updated to 8.11.3.
    * ada updated to 2.7.6.
    * base64 updated to 0.5.2.
    * brotli updated to 1.1.0.
    * c-ares updated to 1.27.0.
    * corepack updated to 0.25.2.
    * ICU updated to 74.2. Includes CLDR 44.1 and Unicode 15.1.
    * nghttp2 updated to 1.60.0.
    * npm updated to 10.5.0. Fixes a regression in signals not being passed onto child processes.
    * simdutf8 updated to 4.0.8.
    * Timezone updated to 2024a.
    * zlib updated to 1.3.0.1-motley-40e35a7.

    ----

    Include `Provides: nodejs20-*` for non-versioned packages.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2780 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)

    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2778 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202505-11 (Node.js: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
200069	RHEL 9 : nodejs:18 (RHSA-2024:3544)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/11/7	high
204593	RHEL 8 : nodejs:18 (RHSA-2024:4824)	Nessus	Red Hat Local Security Checks	2024/7/24	2024/11/7	high
197044	Oracle Linux 9 : nodejs:18 (ELSA-2024-2779)	Nessus	Oracle Linux Local Security Checks	2024/5/15	2025/2/6	medium
197290	Oracle Linux 9 : nodejs:20 (ELSA-2024-2853)	Nessus	Oracle Linux Local Security Checks	2024/5/17	2025/2/6	medium
198074	RHEL 7 : rh-nodejs14 (RHSA-2024:3472)	Nessus	Red Hat Local Security Checks	2024/5/29	2024/11/7	high
199251	RHEL 8 : nodejs : (RHSA-2024:3553)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/11/7	high
201621	CBL Mariner 2.0 Security Update: nodejs18 / nodejs (CVE-2024-27983)	Nessus	MarinerOS Local Security Checks	2024/7/3	2024/7/3	high
193386	SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2024:1308-1)	Nessus	SuSE Local Security Checks	2024/4/17	2024/4/17	high
193655	SUSE SLES15 Security Update : nodejs14 (SUSE-SU-2024:1355-1)	Nessus	SuSE Local Security Checks	2024/4/20	2024/4/20	high
194592	Fedora 40 : nodejs20 (2024-2ffe03eaa6)	Nessus	Fedora Local Security Checks	2024/4/29	2024/11/14	high
195193	RHEL 8 : nodejs:18 (RHSA-2024:2780)	Nessus	Red Hat Local Security Checks	2024/5/9	2025/4/30	medium
195194	RHEL 8 : nodejs:20 (RHSA-2024:2778)	Nessus	Red Hat Local Security Checks	2024/5/9	2025/4/30	medium
236407	GLSA-202505-11 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2025/5/14	2025/5/17	critical

检测

插件搜索

high

high

medium

medium

high

high

high

high

high

high

medium

medium

critical