Alpine: multiple nodejs-current packages: security update to 16.11.1-r0

critical Tenable Cloud Security Plugin ID 405844

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS
(Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain
Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as
system availability. (CVE-2021-3672)

- Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application
crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns
library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection
vulnerabilities in applications using the library. (CVE-2021-22931)

- If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized"
parameter, no error was returned and connections to servers with an expired certificate would have been
accepted. (CVE-2021-22939)

- The parser in accepts requests with a space (SP) right after the header name before the colon. This can
lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. (CVE-2021-22959)

- The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of
chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. (CVE-2021-22960)

Plugin Details

Severity: Critical

ID: 405844

Version: Revision 1.29

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-22931

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 8/11/2021

Reference Information

CVE: CVE-2021-22931, CVE-2021-22939, CVE-2021-22959, CVE-2021-22960, CVE-2021-3672

Detections

Analytics