Amazon Linux AMI update for nodejs20

Published: 2024-08-06

Risk	Medium
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2024-27982 CVE-2024-27983 CVE-2024-28182 CVE-2024-30261
CWE-ID	CWE-444 CWE-617 CWE-20 CWE-345
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #2 is available.
Vulnerable software	Amazon Linux AMI Operating systems & Components / Operating system nodejs20 Operating systems & Components / Operating system package or component
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU88176

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-27982

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Update the affected packages:

aarch64:
    nodejs20-libs-debuginfo-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-full-i18n-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-debuginfo-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-devel-20.12.2-1.amzn2023.0.2.aarch64
    v8-11.3-devel-11.3.244.8-1.20.12.2.1.amzn2023.0.2.aarch64
    nodejs20-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-libs-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-npm-10.5.0-1.20.12.2.1.amzn2023.0.2.aarch64
    nodejs20-debugsource-20.12.2-1.amzn2023.0.2.aarch64

noarch:
    nodejs20-docs-20.12.2-1.amzn2023.0.2.noarch

src:
    nodejs20-20.12.2-1.amzn2023.0.2.src

x86_64:
    nodejs20-libs-debuginfo-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-debuginfo-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-full-i18n-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-devel-20.12.2-1.amzn2023.0.2.x86_64
    v8-11.3-devel-11.3.244.8-1.20.12.2.1.amzn2023.0.2.x86_64
    nodejs20-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-libs-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-npm-10.5.0-1.20.12.2.1.amzn2023.0.2.x86_64
    nodejs20-debugsource-20.12.2-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

nodejs20: before 20.12.2-1

CPE2.3

External links

https://alas.aws.amazon.com/AL2023/ALAS-2024-594.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Reachable Assertion

EUVDB-ID: #VU88175

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2024-27983

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when handling HTTP/2 packets. A remote attacker can send a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    nodejs20-libs-debuginfo-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-full-i18n-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-debuginfo-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-devel-20.12.2-1.amzn2023.0.2.aarch64
    v8-11.3-devel-11.3.244.8-1.20.12.2.1.amzn2023.0.2.aarch64
    nodejs20-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-libs-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-npm-10.5.0-1.20.12.2.1.amzn2023.0.2.aarch64
    nodejs20-debugsource-20.12.2-1.amzn2023.0.2.aarch64

noarch:
    nodejs20-docs-20.12.2-1.amzn2023.0.2.noarch

src:
    nodejs20-20.12.2-1.amzn2023.0.2.src

x86_64:
    nodejs20-libs-debuginfo-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-debuginfo-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-full-i18n-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-devel-20.12.2-1.amzn2023.0.2.x86_64
    v8-11.3-devel-11.3.244.8-1.20.12.2.1.amzn2023.0.2.x86_64
    nodejs20-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-libs-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-npm-10.5.0-1.20.12.2.1.amzn2023.0.2.x86_64
    nodejs20-debugsource-20.12.2-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

nodejs20: before 20.12.2-1

CPE2.3

External links

https://alas.aws.amazon.com/AL2023/ALAS-2024-594.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Input validation error

EUVDB-ID: #VU88144

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-28182

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to reading the unbounded number of HTTP/2 CONTINUATION frames. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    nodejs20-libs-debuginfo-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-full-i18n-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-debuginfo-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-devel-20.12.2-1.amzn2023.0.2.aarch64
    v8-11.3-devel-11.3.244.8-1.20.12.2.1.amzn2023.0.2.aarch64
    nodejs20-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-libs-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-npm-10.5.0-1.20.12.2.1.amzn2023.0.2.aarch64
    nodejs20-debugsource-20.12.2-1.amzn2023.0.2.aarch64

noarch:
    nodejs20-docs-20.12.2-1.amzn2023.0.2.noarch

src:
    nodejs20-20.12.2-1.amzn2023.0.2.src

x86_64:
    nodejs20-libs-debuginfo-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-debuginfo-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-full-i18n-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-devel-20.12.2-1.amzn2023.0.2.x86_64
    v8-11.3-devel-11.3.244.8-1.20.12.2.1.amzn2023.0.2.x86_64
    nodejs20-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-libs-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-npm-10.5.0-1.20.12.2.1.amzn2023.0.2.x86_64
    nodejs20-debugsource-20.12.2-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

nodejs20: before 20.12.2-1

CPE2.3

External links

https://alas.aws.amazon.com/AL2023/ALAS-2024-594.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Insufficient verification of data authenticity

EUVDB-ID: #VU88178

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-30261

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to the application does not verify authenticity of data. A remote attacker can alter the "integrity" option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered.

Mitigation

Update the affected packages:

aarch64:
    nodejs20-libs-debuginfo-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-full-i18n-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-debuginfo-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-devel-20.12.2-1.amzn2023.0.2.aarch64
    v8-11.3-devel-11.3.244.8-1.20.12.2.1.amzn2023.0.2.aarch64
    nodejs20-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-libs-20.12.2-1.amzn2023.0.2.aarch64
    nodejs20-npm-10.5.0-1.20.12.2.1.amzn2023.0.2.aarch64
    nodejs20-debugsource-20.12.2-1.amzn2023.0.2.aarch64

noarch:
    nodejs20-docs-20.12.2-1.amzn2023.0.2.noarch

src:
    nodejs20-20.12.2-1.amzn2023.0.2.src

x86_64:
    nodejs20-libs-debuginfo-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-debuginfo-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-full-i18n-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-devel-20.12.2-1.amzn2023.0.2.x86_64
    v8-11.3-devel-11.3.244.8-1.20.12.2.1.amzn2023.0.2.x86_64
    nodejs20-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-libs-20.12.2-1.amzn2023.0.2.x86_64
    nodejs20-npm-10.5.0-1.20.12.2.1.amzn2023.0.2.x86_64
    nodejs20-debugsource-20.12.2-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

nodejs20: before 20.12.2-1

CPE2.3

External links

https://alas.aws.amazon.com/AL2023/ALAS-2024-594.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.