Read Time:3 Second
New medical devices applications should “monitor, identify, and address” cybersecurity issues
Daily Archives: March 30, 2023
Kyndryl lays off staff in search of efficiency
Read Time:5 Second
The layoffs are part of a restructuring initiative aimed at improving efficiency and customer service, Kyndryl says.
nodejs16-16.20.0-1.fc38 nodejs18-18.15.0-5.fc38 nodejs20-19.8.1-6.fc38
Read Time:1 Minute, 53 Second
FEDORA-2023-cdd4df1681
Packages in this update:
nodejs16-16.20.0-1.fc38
nodejs18-18.15.0-5.fc38
nodejs20-19.8.1-6.fc38
Update description:
Assorted fixes for v8-devel
Update to 19.8.1
Fix confilct with nodejs18
2023-02-16, Version 16.19.1 ‘Gallium’ (LTS), @richardlau
This is a security release.
Notable Changes
The following CVEs are fixed in this release:
CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
Fixed by an update to undici:
CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
See https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff for more information.
CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
See https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w for more information.
More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.
This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.
Commits
[7fef050447] – build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
[b558e9f476] – crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) nodejs-private/node-private#375
[160adb7ffc] – crypto: clear OpenSSL error queue after calling X509_check_private_key() (Filip Skokan) #45495
[d0ece30948] – crypto: clear OpenSSL error queue after calling X509_verify() (Takuro Sato) #45377
[2d9ae4f184] – deps: update undici to v5.19.1 (Matteo Collina) nodejs-private/node-private#388
[d80e8312fd] – deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46568
[de5c8d2c2f] – deps: update archs files for quictls/openssl-1.1.1t+quic (RafaelGSS) #46568
[1a8ccfe908] – deps: upgrade openssl sources to OpenSSL_1_1_1t+quic (RafaelGSS) #46568
[693789780b] – doc: clarify release notes for Node.js 16.19.0 (Richard Lau) #45846
[f95ef064f4] – lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
[b02d895137] – policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358
[d7f83c420c] – test: avoid left behind child processes (Richard Lau) #46276
nodejs16-16.20.0-1.fc37 nodejs18-18.15.0-5.fc37 nodejs20-19.8.1-6.fc37
Read Time:1 Minute, 53 Second
FEDORA-2023-c9c9af3c3d
Packages in this update:
nodejs16-16.20.0-1.fc37
nodejs18-18.15.0-5.fc37
nodejs20-19.8.1-6.fc37
Update description:
Assorted fixes for v8-devel
Update to 19.8.1
Fix confilct with nodejs18
2023-02-16, Version 16.19.1 ‘Gallium’ (LTS), @richardlau
This is a security release.
Notable Changes
The following CVEs are fixed in this release:
CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
Fixed by an update to undici:
CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
See https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff for more information.
CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
See https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w for more information.
More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.
This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.
Commits
[7fef050447] – build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
[b558e9f476] – crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) nodejs-private/node-private#375
[160adb7ffc] – crypto: clear OpenSSL error queue after calling X509_check_private_key() (Filip Skokan) #45495
[d0ece30948] – crypto: clear OpenSSL error queue after calling X509_verify() (Takuro Sato) #45377
[2d9ae4f184] – deps: update undici to v5.19.1 (Matteo Collina) nodejs-private/node-private#388
[d80e8312fd] – deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46568
[de5c8d2c2f] – deps: update archs files for quictls/openssl-1.1.1t+quic (RafaelGSS) #46568
[1a8ccfe908] – deps: upgrade openssl sources to OpenSSL_1_1_1t+quic (RafaelGSS) #46568
[693789780b] – doc: clarify release notes for Node.js 16.19.0 (Richard Lau) #45846
[f95ef064f4] – lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
[b02d895137] – policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358
[d7f83c420c] – test: avoid left behind child processes (Richard Lau) #46276
APT group Winter Vivern exploits Zimbra webmail flaw to target government entities
Read Time:52 Second
An APT group known in the security industry as Winter Vivern has been exploiting a vulnerability in the Zimbra Collaboration software to gain access to mailboxes from government agencies in several European countries. While no clear links have been established between Winter Vivern and a particular country’s government, security researchers have noted that its activities closely align with the interests of Russia and Belarus.
The group, which is also tracked as TA473 or UAC-0114, has been operating since at least 2021 and past victims were identified in Lithuania, India, Vatican, and Slovakia. According to a report earlier this month by cybersecurity firm SentinelLabs, more recent targets include Polish government agencies, Ukraine’s Ministry of Foreign Affairs, Italy’s Ministry of Foreign Affairs, individuals within the Indian government, and telecommunications companies that support Ukraine in the ongoing war. In a new report released today, cybersecurity firm Proofpoint said it saw Winter Vivern campaigns late last year that targeted elected officials in the United States and their staffers.
3CX DesktopApp compromised by supply chain attack
Read Time:33 Second
3CX is working on a software update for its 3CX DesktopApp, after multiple security researchers alerted the company of an active supply chain attack in it. The update will be released in the next few hours; meanwhile the company urges customers to use its PWA (progressive web application) client instead.
“As many of you have noticed the 3CX DesktopApp has a malware in it. It affects the Windows Electron client for customers running update 7,” Nick Galea, CEO at 3CX said in a security alert on Thursday. As an immediate response, the company advised users to uninstall and reinstall the app.
USN-5989-1: GlusterFS vulnerability
Read Time:8 Second
Tao Lyu discovered that GlusterFS did not properly handle certain
event notifications. An attacker could possibly use this issue to
cause a denial of service.