跳转到帖子

Red Hat: CVE-2024-22018: nodejs: fs.lstat bypasses permission model (Multiple Advisories)

recommended_posts

发布于
  • Members

Red Hat: CVE-2024-22018: nodejs: fs.lstat bypasses permission model (Multiple Advisories)

Severity
1
CVSS
(AV:L/AC:H/Au:N/C:P/I:N/A:N)
Published
07/10/2024
Created
09/14/2024
Added
09/13/2024
Modified
09/13/2024

Description

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Solution(s)

  • redhat-upgrade-nodejs
  • redhat-upgrade-nodejs-debuginfo
  • redhat-upgrade-nodejs-debugsource
  • redhat-upgrade-nodejs-devel
  • redhat-upgrade-nodejs-docs
  • redhat-upgrade-nodejs-full-i18n
  • redhat-upgrade-nodejs-nodemon
  • redhat-upgrade-nodejs-packaging
  • redhat-upgrade-nodejs-packaging-bundler
  • redhat-upgrade-npm

References

  • CVE-2024-22018
  • RHSA-2024:5814
  • RHSA-2024:5815
  • 查看数 699
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…