The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0350 advisory.

    nodejs     [1:14.18.2-2]
    - Add missing fixes
    - Resolves: RHBZ#2027642, RHBZ#2027635

    [1:14.18.2-1]
    - Resolves: RHBZ#2027609
    - Resolves: RHBZ#2027649, RHBZ#2027646, RHBZ#2027642, RHBZ#2027635
    - Rebase to new version to fix CVEs

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2259:02 advisory.

    * nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()     (CVE-2021-23362)
      * nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)
      * normalize-url: ReDoS for data URLs (CVE-2021-33502)
      * libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes     (CVE-2021-22918)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the nodejs-nodemon-2.0.19-1.el9 build changelog.

  - This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in     enclosure containing path separator. (CVE-2020-28469)

  - The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS     (regular expression denial of service) issue because it has exponential performance for data: URLs.
    (CVE-2021-33502)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4711 advisory.

    The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform     that allows system administrators to view and manage virtual machines. The Manager provides a     comprehensive range of features including search capabilities, resource management, live migrations, and     virtual infrastructure provisioning.

    Security Fix(es):

    * nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes     (CVE-2021-3807)

    * nodejs-trim-off-newlines: ReDoS via string processing (CVE-2021-23425)

    * normalize-url: ReDoS for data URLs (CVE-2021-33502)

    * jquery-ui: XSS in the altField option of the datepicker widget (CVE-2021-41182)

    * jquery-ui: XSS in *Text options of the datepicker widget (CVE-2021-41183)

    * jquery-ui: XSS in the 'of' option of the .position() util (CVE-2021-41184)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    A list of bugs fixed in this update is available in the Technical Notes book:

    https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
157333	Oracle Linux 8 : nodejs:14 (ELSA-2022-0350)	Nessus	Oracle Linux Local Security Checks	2/2/2022	11/1/2024	critical
294117	MiracleLinux 7 : rh-nodejs12-nodejs-nodemon-2.0.3-2.el7, rh-nodejs12-nodejs-12.22.2-1.el7 (AXSA:2021-2259:02)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	medium
191419	CentOS 9 : nodejs-nodemon-2.0.19-1.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	medium
161619	RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.0] (RHSA-2022:4711)	Nessus	Red Hat Local Security Checks	5/27/2022	11/7/2024	medium

Detections

Analytics

Plugins Search

critical

medium

medium

medium