kritisch
CVE-2024-21896
nodejs: path traversal by monkey-patching buffer internals
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.9CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Azure Linux, Bitnami, Photon OS. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Amazon (hoch), Oracle (hoch), Rocky Linux (hoch).
Beschreibung
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Azure Linux 3.0 | nodejs | 0:20.14.0-1.azl3 |
| bitnami::Bitnami Vulnerability Database | node, node-min | 20.12.0, 22.1.0 und 1 weitere |
| Photon OS 5.0 | nodejs, nodejs-devel | 20.11.1-1.ph5 |
| alma 8 | nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs und 5 weitere | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 und 3 weitere |
| alma 9 | nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs und 5 weitere | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 und 3 weitere |
| amazon linux 2023 | nodejs20, nodejs20-debuginfo, nodejs20-debugsource und 7 weitere | 1:20.11.1-1.amzn2023.0.1 und 2 weitere |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs und 5 weitere | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 und 3 weitere |
| Oracle Linux 9 | nodejs, nodejs-devel, nodejs-docs und 5 weitere | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 und 3 weitere |
| rapidfort alma 9 | nodejs, nodejs-docs, nodejs-full-i18n und 2 weitere | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a und 2 weitere |
| rapidfort amazon linux 2023 | nodejs20, nodejs20-devel, nodejs20-docs und 3 weitere | 1:20.11.1-1.amzn2023.0.1 und 1 weitere |
| rapidfort Oracle Linux 9 | nodejs, nodejs-docs, nodejs-full-i18n und 2 weitere | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a und 2 weitere |
| rapidfort Red Hat 9 | nodejs, nodejs-docs, nodejs-full-i18n und 2 weitere | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a und 2 weitere |
Alle 89 Einträge aus 18 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Azure Linux 3.0 | nodejs | 0:20.14.0-1.azl3 |
| bitnami::Bitnami Vulnerability Database | node | 20.12.0, 22.1.0 |
| bitnami::Bitnami Vulnerability Database | node-min | 20.18.1, 22.12.0 |
| Photon OS 5.0 | nodejs | 20.11.1-1.ph5 |
| Photon OS 5.0 | nodejs-devel | 20.11.1-1.ph5 |
| alma 8 | nodejs:20::nodejs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-devel | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-docs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| alma 8 | nodejs:20::nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| alma 8 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| alma 8 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35 |
| alma 9 | nodejs:20::nodejs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-devel | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-docs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 |
| alma 9 | nodejs:20::nodejs-packaging | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| alma 9 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| alma 9 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2 |
| amazon linux 2023 | nodejs20 | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-debuginfo | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-debugsource | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-devel | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-docs | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-full-i18n | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-libs | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-libs-debuginfo | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.1 |
| amazon linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.11.1.1.amzn2023.0.1 |
| Oracle Linux 8 | nodejs | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-devel | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-docs | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-full-i18n | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-packaging | 2021.06-4.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-packaging-bundler | 2021.06-4.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | npm | 1:10.2.4-1.20.11.1.1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 9 | nodejs | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-devel | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | nodejs-packaging | 2021.06-4.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | nodejs-packaging-bundler | 2021.06-4.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+90254+3f4d3ee1 |
| rapidfort alma 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781, 3.0.1-1.module_el9.3.0+47+c33bc288 |
| rapidfort alma 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort amazon linux 2023 | nodejs20 | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-devel | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-docs | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-full-i18n | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-libs | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.1 |
| rapidfort Oracle Linux 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| rapidfort Oracle Linux 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| rapidfort Red Hat 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| rapidfort rocky 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort ubuntu 20.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 20.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 22.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 22.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 24.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 24.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rocky 8 | nodejs:20::nodejs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-devel | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-docs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-nodemon | 3.0.1-1.module+el8.8.0+1459+02651ab6 |
| rocky 8 | nodejs:20::nodejs-packaging | 2021.06-4.module+el8.7.0+1072+5b168780 |
| rocky 8 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module+el8.7.0+1072+5b168780 |
| rocky 8 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module+el8.9.0+1776+addd4aec |
| rocky 9 | nodejs:22::nodejs-nodemon | 3.0.1-1.module+el9.6.0+32143+ae966e5b |
| rocky 9 | nodejs:22::nodejs-packaging | 2021.06-4.module+el9.6.0+32185+bd121a25 |
| rocky 9 | nodejs:22::nodejs-packaging-bundler | 2021.06-4.module+el9.6.0+32185+bd121a25 |
Referenzen
- http://www.openwall.com/lists/oss-security/2024/03/11/1
- https://access.redhat.com/errata/RHSA-2024:1688
- https://access.redhat.com/security/cve/CVE-2024-21896
- https://bugzilla.redhat.com/2264569
- https://bugzilla.redhat.com/2264574
- https://bugzilla.redhat.com/2264582
- https://bugzilla.redhat.com/2265717
- https://bugzilla.redhat.com/2265720
Alle 36 Referenzen
- https://bugzilla.redhat.com/2265722
- https://bugzilla.redhat.com/2265727
- https://bugzilla.redhat.com/show_bug.cgi?id=2264569
- https://bugzilla.redhat.com/show_bug.cgi?id=2264574
- https://bugzilla.redhat.com/show_bug.cgi?id=2264582
- https://bugzilla.redhat.com/show_bug.cgi?id=2265717
- https://bugzilla.redhat.com/show_bug.cgi?id=2265720
- https://bugzilla.redhat.com/show_bug.cgi?id=2265722
- https://bugzilla.redhat.com/show_bug.cgi?id=2265727
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46809
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21890
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21891
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21892
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21896
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22017
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22019
- https://errata.almalinux.org/9/ALSA-2024-1688.html
- https://errata.rockylinux.org/RLSA-2024:1688
- https://github.com/nodejs/node/releases/tag/v20.11.1
- https://github.com/nodejs/node/releases/tag/v21.6.2
- https://hackerone.com/reports/2218653
- https://linux.oracle.com/cve/CVE-2024-21896.html
- https://linux.oracle.com/errata/ELSA-2024-1688.html
- https://nodejs.org/en/blog/vulnerability/february-2024-security-releases#path-traversal-by-monkey-patching-buffer-internals-cve-2024-21896---high
- https://nvd.nist.gov/vuln/detail/CVE-2024-21896
- https://security.netapp.com/advisory/ntap-20240329-0002/
- https://www.cve.org/CVERecord?id=CVE-2024-21896