Red Hat Software Collections update for rh-nodejs10-nodejs
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2021-22883 CVE-2021-22884 |
| CWE-ID | CWE-399 CWE-350 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
rh-nodejs10-nodejs (Red Hat package) Operating systems & Components / Operating system package or component Red Hat Software Collections Universal components / Libraries / Software for developers |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Resource management error
EUVDB-ID: #VU50954
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-22883
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within the application when processing multiple connection attempts with an 'unknownProtocol'. A remote attacker can initiate multiple connections with the server, which will trigger a leak of file descriptors and result in a denial of service (DoS) condition.
Install updates from vendor's website.
rh-nodejs10-nodejs (Red Hat package): 10.10.0-3.el7 - 10.21.0-3.el7
Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7
CPE2.3- cpe:2.3:o:red_hat:rh-nodejs10-nodejs_redhat_package:10.10.0-3.el7:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rh-nodejs10-nodejs_redhat_package:10.16.3-3.el7:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rh-nodejs10-nodejs_redhat_package:10.19.0-1.el7:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_software_collections:1 for RHEL 7:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:red_hat_software_collections:1 for RHEL 7.7:*:*:*:*:*:*:*
https://access.redhat.com/errata/RHSA-2021:0827
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) DNS rebinding
EUVDB-ID: #VU50955
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-22884
CWE-ID:
CWE-350 - Reliance on Reverse DNS Resolution for a Security-Critical Action
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform DNS rebinding attack.
The vulnerability exists due to the application whitelist includes the “localhost6” name. When “localhost6” is not present in /etc/hosts, it is treated an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain.
MitigationInstall updates from vendor's website.
rh-nodejs10-nodejs (Red Hat package): 10.10.0-3.el7 - 10.21.0-3.el7
Red Hat Software Collections: 1 for RHEL 7 - 1 for RHEL 7.7
CPE2.3- cpe:2.3:o:red_hat:rh-nodejs10-nodejs_redhat_package:10.10.0-3.el7:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rh-nodejs10-nodejs_redhat_package:10.16.3-3.el7:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:rh-nodejs10-nodejs_redhat_package:10.19.0-1.el7:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_software_collections:1 for RHEL 7:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:red_hat_software_collections:1 for RHEL 7.7:*:*:*:*:*:*:*
https://access.redhat.com/errata/RHSA-2021:0827
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
