VulnerableCode Package Details - pkg:rpm/redhat/rh-nodejs14-nodejs@14.17.5-1?arch=el7

Search for packages

Vulnerability	Summary	Fixed by
VCID-1xdz-dku3-qqc4 Aliases: CVE-2021-3672	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.	There are no reported fixed by versions.
VCID-53xm-8w84-93cx Aliases: CVE-2021-22930	Multiple vulnerabilities have been found in c-ares, the worst of which could result in the loss of confidentiality or integrity.	There are no reported fixed by versions.
VCID-7cth-47w2-17hy Aliases: CVE-2021-22940	Multiple vulnerabilities have been found in c-ares, the worst of which could result in the loss of confidentiality or integrity.	There are no reported fixed by versions.
VCID-9g7s-y7nq-xfbb Aliases: CVE-2021-22939	Multiple vulnerabilities have been found in c-ares, the worst of which could result in the loss of confidentiality or integrity.	There are no reported fixed by versions.
VCID-a9w9-1d4p-vqau Aliases: CVE-2021-32804 GHSA-3jfq-g458-7qm9	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.	There are no reported fixed by versions.
VCID-ap4u-dkwx-1kb3 Aliases: CVE-2021-22931	Multiple vulnerabilities have been found in c-ares, the worst of which could result in the loss of confidentiality or integrity.	There are no reported fixed by versions.
VCID-e7n4-x8sc-3bb6 Aliases: CVE-2021-32803 GHSA-r628-mhmh-qjhw	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.	There are no reported fixed by versions.
VCID-tsp3-tyjt-h7bk Aliases: CVE-2021-23343 GHSA-hj48-42vr-x3v9	Regular Expression Denial of Service in path-parse Affected versions of npm package `path-parse` are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-1xdz-dku3-qqc4
Aliases:
CVE-2021-3672

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.