SB2025021278 - Red Hat Enterprise Linux 8 update for the nodejs:20 module
Published: February 12, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Use of insufficiently random values (CVE-ID: CVE-2025-22150)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to the application uses "Math.random()" from the fetch() function to choose the boundary for a "multipart/form-data" request. A remote attacker with ability to intercept traffic can tamper with the requests going to the backend APIs.
2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-23083)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to improperly imposed security restrictions when handling diagnostics data with diagnostics_channel utility. A remote user can hook the utility to internal workers and gain access to sensitive information.
3) Memory leak (CVE-ID: CVE-2025-23085)
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak when a remote peer abruptly closes the socket without sending a GOAWAY notification. A remote attacker can force the application to leak memory and perform denial of service attack.
Remediation
Install update from vendor's website.