Multiple vulnerabilities were discovered in Node.js, a JavaScript
runtime environment, which could result in memory corruption, invalid
certificate validation, prototype pollution or command injection.
* [CVE-2021-22930](https://security-tracker.debian.org/tracker/CVE-2021-22930), [CVE-2021-22940](https://security-tracker.debian.org/tracker/CVE-2021-22940)
Use after free attack where an attacker might be able to exploit
the memory corruption, to change process behavior.
* [CVE-2021-22939](https://security-tracker.debian.org/tracker/CVE-2021-22939)
If the Node.js https API was used incorrectly and undefined was
in passed for the rejectUnauthorized parameter, no error was
returned and connections to servers with an expired certificate
would have been accepted.
* [CVE-2022-21824](https://security-tracker.debian.org/tracker/CVE-2022-21824)
Due to the formatting logic of the “console.table()” function it
was not safe to allow user controlled input to be passed to the
properties parameter while simultaneously passing a plain object
with at least one property as the first parameter, which could be
__proto__.
* [CVE-2022-32212](https://security-tracker.debian.org/tracker/CVE-2022-32212)
OS Command Injection vulnerability due to an insufficient
IsAllowedHost check that can easily be bypassed because
IsIPAddress does not properly check if an IP address is invalid
before making DBS requests allowing rebinding attacks.
For Debian 10 buster, these problems have been fixed in version
10.24.0~dfsg-1~deb10u2.
We recommend that you upgrade your nodejs packages.
For the detailed security status of nodejs please refer to
its security tracker page at:
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: Read More