Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0232 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-25883:
      Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service     (ReDoS) via the function new Range, when untrusted user data is provided as a range.

      CVE-2023-32002:
      The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module.

      This vulnerability affects all users using the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x.

      Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

      CVE-2023-32006:
      The use of module.constructor.createRequire() can bypass the policy mechanism and require modules     outside of the policy.json definition for a given module.

      This vulnerability affects all users using the experimental policy mechanism in all active release     lines: 16.x, 18.x, and, 20.x.

      Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

      CVE-2023-32559:
      A privilege escalation vulnerability exists in the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding() can bypass the policy     mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run     arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE     was issued, the policy is an experimental feature of Node.js.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0231 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-25883:
      Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service     (ReDoS) via the function new Range, when untrusted user data is provided as a range.

      CVE-2023-32002:
      The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module.

      This vulnerability affects all users using the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x.

      Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

      CVE-2023-32006:
      The use of module.constructor.createRequire() can bypass the policy mechanism and require modules     outside of the policy.json definition for a given module.

      This vulnerability affects all users using the experimental policy mechanism in all active release     lines: 16.x, 18.x, and, 20.x.

      Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

      CVE-2023-32559:
      A privilege escalation vulnerability exists in the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding() can bypass the policy     mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run     arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE     was issued, the policy is an experimental feature of Node.js.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS)     via the function new Range, when untrusted user data is provided as a range. (CVE-2022-25883)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5486 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)

    * log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an     Unauthorized actor (CVE-2023-4061)

    * tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

    * bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)

    * netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5485 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)

    * log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an     Unauthorized actor (CVE-2023-4061)

    * tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

    * bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)

    * netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5484 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)

    * log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an     Unauthorized actor (CVE-2023-4061)

    * tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

    * bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)

    * netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:5363 advisory.

  - Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS)     via the function new Range, when untrusted user data is provided as a range. (CVE-2022-25883)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

  - The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules     outside of the policy.json definition for a given module. This vulnerability affects all users using the     experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the     time this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32006)

  - A privilege escalation vulnerability exists in the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy     mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')`     run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time     this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-5363 advisory.

    - Rebase to version 18.17.1       Resolves: rhbz#2228940       Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-5360 advisory.

    - Rebase to 16.20.2       Resolves: rhbz#2231866       Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559

    nodejs-nodemon
    - Rebase to 3.0.1       Resolves: CVE-2022-25883

    nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-5362 advisory.

    - Rebase to version 18.17.1       Resolves: rhbz#2228939       Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:5360 advisory.

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)
    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)
    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)
    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:5363 advisory.

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)
    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)
    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)
    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:5362 advisory.

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)
    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)
    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)
    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:5362 advisory.

  - Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS)     via the function new Range, when untrusted user data is provided as a range. (CVE-2022-25883)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

  - The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules     outside of the policy.json definition for a given module. This vulnerability affects all users using the     experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the     time this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32006)

  - A privilege escalation vulnerability exists in the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy     mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')`     run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time     this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5362 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2234409)

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5361 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (16). (BZ#2223679,     BZ#2223681, BZ#2223683, BZ#2223685, BZ#2223687, BZ#2233892)

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs:16/nodejs: nodejs.prov doesn't generate the bundled dependency for modules starting @ like     @colors/colors (BZ#2237395)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5363 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2223313,     BZ#2234404)

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5360 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (16). (BZ#2233891)

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs:16/nodejs: nodejs.prov doesn't generate the bundled dependency for modules starting @ like     @colors/colors (BZ#2237394)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-290 advisory.

    Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS)     via the function new Range, when untrusted user data is provided as a range. (CVE-2022-25883)

    Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header     map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames     from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame     skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code     path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The     clean-up code is right after the return statement, causing memory leak. Denial of service through memory     exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
    (CVE-2023-35945)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
239225	TencentOS Server 3: nodejs:18 (TSSA-2023:0232)	Nessus	Tencent Local Security Checks	critical
238814	TencentOS Server 3: nodejs:16 (TSSA-2023:0231)	Nessus	Tencent Local Security Checks	critical
224529	Linux Distros Unpatched Vulnerability : CVE-2022-25883	Nessus	Misc.	high
182684	RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9 (Important) (RHSA-2023:5486)	Nessus	Red Hat Local Security Checks	critical
182683	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8 (Important) (RHSA-2023:5485)	Nessus	Red Hat Local Security Checks	critical
182622	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7 (Important) (RHSA-2023:5484)	Nessus	Red Hat Local Security Checks	critical
182618	Rocky Linux 9 : nodejs:18 (RLSA-2023:5363)	Nessus	Rocky Linux Local Security Checks	critical
182518	Oracle Linux 9 : nodejs:18 (ELSA-2023-5363)	Nessus	Oracle Linux Local Security Checks	critical
182088	Oracle Linux 8 : nodejs:16 (ELSA-2023-5360)	Nessus	Oracle Linux Local Security Checks	critical
182087	Oracle Linux 8 : nodejs:18 (ELSA-2023-5362)	Nessus	Oracle Linux Local Security Checks	critical
182075	AlmaLinux 8 : nodejs:16 (ALSA-2023:5360)	Nessus	Alma Linux Local Security Checks	critical
182074	AlmaLinux 9 : nodejs:18 (ALSA-2023:5363)	Nessus	Alma Linux Local Security Checks	critical
181897	AlmaLinux 8 : nodejs:18 (ALSA-2023:5362)	Nessus	Alma Linux Local Security Checks	critical
181894	CentOS 8 : nodejs:18 (CESA-2023:5362)	Nessus	CentOS Local Security Checks	critical
181893	RHEL 8 : nodejs:18 (RHSA-2023:5362)	Nessus	Red Hat Local Security Checks	critical
181892	RHEL 8 : nodejs:16 (RHSA-2023:5361)	Nessus	Red Hat Local Security Checks	critical
181890	RHEL 9 : nodejs:18 (RHSA-2023:5363)	Nessus	Red Hat Local Security Checks	critical
181889	RHEL 8 : nodejs:16 (RHSA-2023:5360)	Nessus	Red Hat Local Security Checks	critical
179757	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-290)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-25883

high

Tenable Plugins

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high