Количество 43
Количество 43
ELSA-2022-9945
ELSA-2022-9945: GraalVM Security update (IMPORTANT)
ELSA-2022-9944
ELSA-2022-9944: GraalVM Security update (IMPORTANT)
CVE-2022-35255
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
CVE-2022-35255
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
CVE-2022-35255
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
CVE-2022-35255
A weak randomness in WebCrypto keygen vulnerability exists in Node.js ...
CVE-2022-35256
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
CVE-2022-35256
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
CVE-2022-35256
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
CVE-2022-35256
CVE-2022-35256
The llhttp parser in the http module in Node v18.7.0 does not correctl ...
GHSA-p36x-w6hr-88jp
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
GHSA-rc2m-q589-vpqx
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
BDU:2023-00348
Уязвимость анализатора HTTP-кода llhttp программного обеспечения для управления сетевой инфраструктурой SINEC INS (Infrastructure Network Services), позволяющая нарушителю выполнить произвольный код
SUSE-SU-2022:3835-1
Security update for nodejs10
SUSE-SU-2022:3616-1
Security update for nodejs12
SUSE-SU-2022:3614-1
Security update for nodejs14
SUSE-SU-2022:3516-1
Security update for nodejs14
SUSE-SU-2022:3503-1
Security update for nodejs12
RLSA-2023:0321
Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| ELSA-2022-9945 ELSA-2022-9945: GraalVM Security update (IMPORTANT) | больше 2 лет назад | ||
| ELSA-2022-9944 ELSA-2022-9944: GraalVM Security update (IMPORTANT) | больше 2 лет назад | ||
 | CVE-2022-35255 A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material. | CVSS3: 9.1 | 1% Низкий | больше 2 лет назад |
 | CVE-2022-35255 A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material. | CVSS3: 8.2 | 1% Низкий | больше 2 лет назад |
 | CVE-2022-35255 A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material. | CVSS3: 9.1 | 1% Низкий | больше 2 лет назад |
| CVE-2022-35255 A weak randomness in WebCrypto keygen vulnerability exists in Node.js ... | CVSS3: 9.1 | 1% Низкий | больше 2 лет назад |
| CVE-2022-35256 The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. | CVSS3: 6.5 | 4% Низкий | больше 2 лет назад |
| CVE-2022-35256 The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. | CVSS3: 6.5 | 4% Низкий | больше 2 лет назад |
| CVE-2022-35256 The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. | CVSS3: 6.5 | 4% Низкий | больше 2 лет назад |
 | CVSS3: 6.5 | 4% Низкий | больше 2 лет назад | |
| CVE-2022-35256 The llhttp parser in the http module in Node v18.7.0 does not correctl ... | CVSS3: 6.5 | 4% Низкий | больше 2 лет назад |
| GHSA-p36x-w6hr-88jp A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material. | CVSS3: 9.1 | 1% Низкий | больше 2 лет назад |
| GHSA-rc2m-q589-vpqx The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. | CVSS3: 9.8 | 4% Низкий | больше 2 лет назад |
 | BDU:2023-00348 Уязвимость анализатора HTTP-кода llhttp программного обеспечения для управления сетевой инфраструктурой SINEC INS (Infrastructure Network Services), позволяющая нарушителю выполнить произвольный код | CVSS3: 9.8 | 4% Низкий | больше 2 лет назад |
 | SUSE-SU-2022:3835-1 Security update for nodejs10 | больше 2 лет назад | ||
| SUSE-SU-2022:3616-1 Security update for nodejs12 | больше 2 лет назад | ||
| SUSE-SU-2022:3614-1 Security update for nodejs14 | больше 2 лет назад | ||
| SUSE-SU-2022:3516-1 Security update for nodejs14 | больше 2 лет назад | ||
| SUSE-SU-2022:3503-1 Security update for nodejs12 | больше 2 лет назад | ||
 | RLSA-2023:0321 Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update | больше 2 лет назад |
Уязвимостей на страницу