SB2025032974 - Anolis OS update for nodejs:20 module
Published: March 29, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 secuirty vulnerabilities.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-22018)
The vulnerability allows a remote user to bypass permissions model.
The vulnerability exists due to application does not properly impose security restrictions when experimental permission model when the --allow-fs-read flag is used. A remote user can retrieve stats from files that they do not have explicit read access to.
2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-22020)
The disclosed vulnerability allows a remote user to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input when handling non-network imports in data URLs. A remote user can bypass network import restrictions and execute arbitrary code.
3) Resource exhaustion (CVE-ID: CVE-2024-28863)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources while parsing a tar file. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-36137)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to application does not properly impose security restrictions in the experimental permission model when the --allow-fs-write flag is used. A remote user can change file ownership and permissions via fs.fchown and fs.fchmod.
5) Inconsistency between implementation and documented design (CVE-ID: CVE-2024-21890)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper handling of wildcards in --allow-fs-read and --allow-fs-write. A remote attacker can gain access to sensitive information.
6) Path traversal (CVE-ID: CVE-2024-21891)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
7) Path traversal (CVE-ID: CVE-2024-21896)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in Buffer.prototype.utf8Write. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
8) Improper Privilege Management (CVE-ID: CVE-2024-22017)
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). A local user can escalate privileges on the system.
9) Path traversal (CVE-ID: CVE-2023-39331)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to insufficient patch for #VU77594 (CVE-2023-30584). A remote user can send a specially crafted request and read arbitrary files on the system.
10) Path traversal (CVE-ID: CVE-2023-30584)
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error within the experimental permission model when verifying file permissions. A remote user can send a specially crafted request and read arbitrary files on the system.
11) Path traversal (CVE-ID: CVE-2023-39332)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in paths stored in Uint8Array. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
12) Path traversal (CVE-ID: CVE-2023-32004)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to improper handling of Buffers in file system APIs. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
Remediation
Install update from vendor's website.