SB2023071433 - Anolis OS update for nodejs:18 module
Published: July 14, 2023 Updated: March 29, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2022-4904)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the config_sortlist() function. A local user can trigger memory corruption and perform a denial of service (DoS) attack.
2) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2023-31124)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error when cross-compiling c-ares and using the autotools build system. As a result, the CARES_RANDOM_FILE is not be set, which results in usage of a rand() function as a fallback, leading to weak entropy.
3) Buffer Underwrite ('Buffer Underflow') (CVE-ID: CVE-2023-31130)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a buffer underflow when using certain IPv6 addresses, such as 0::00:00:00/2". A local privileged user can trigger a boundary error and crash the service.
4) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: CVE-2023-31147)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to usage of a rand() function in case /dev/urandom or RtlGenRandom() are unavailable. A remote attacker can perform spoofing attack.
5) Input validation error (CVE-ID: CVE-2023-32067)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
6) Input validation error (CVE-ID: CVE-2023-32067)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when processing DNS responses. A remote attacker can send a specially crafted DNS response to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.