crítica
CVE-2024-21896
nodejs: path traversal by monkey-patching buffer internals
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.9CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Azure Linux, Bitnami, Photon OS. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Oracle (alta), Rocky Linux (alta).
Descripción
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Azure Linux 3.0 | nodejs | 0:20.14.0-1.azl3 |
| bitnami::Bitnami Vulnerability Database | node, node-min | 20.12.0, 22.1.0 y 1 más |
| Photon OS 5.0 | nodejs, nodejs-devel | 20.11.1-1.ph5 |
| alma 8 | nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs y 5 más | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 y 3 más |
| alma 9 | nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs y 5 más | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 y 3 más |
| amazon linux 2023 | nodejs20, nodejs20-debuginfo, nodejs20-debugsource y 7 más | 1:20.11.1-1.amzn2023.0.1 y 2 más |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs y 5 más | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 y 3 más |
| Oracle Linux 9 | nodejs, nodejs-devel, nodejs-docs y 5 más | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 y 3 más |
| rapidfort alma 9 | nodejs, nodejs-docs, nodejs-full-i18n y 2 más | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a y 2 más |
| rapidfort amazon linux 2023 | nodejs20, nodejs20-devel, nodejs20-docs y 3 más | 1:20.11.1-1.amzn2023.0.1 y 1 más |
| rapidfort Oracle Linux 9 | nodejs, nodejs-docs, nodejs-full-i18n y 2 más | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a y 2 más |
| rapidfort Red Hat 9 | nodejs, nodejs-docs, nodejs-full-i18n y 2 más | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a y 2 más |
Mostrar las 89 entradas de 18 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Azure Linux 3.0 | nodejs | 0:20.14.0-1.azl3 |
| bitnami::Bitnami Vulnerability Database | node | 20.12.0, 22.1.0 |
| bitnami::Bitnami Vulnerability Database | node-min | 20.18.1, 22.12.0 |
| Photon OS 5.0 | nodejs | 20.11.1-1.ph5 |
| Photon OS 5.0 | nodejs-devel | 20.11.1-1.ph5 |
| alma 8 | nodejs:20::nodejs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-devel | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-docs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| alma 8 | nodejs:20::nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| alma 8 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| alma 8 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35 |
| alma 9 | nodejs:20::nodejs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-devel | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-docs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 |
| alma 9 | nodejs:20::nodejs-packaging | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| alma 9 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| alma 9 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2 |
| amazon linux 2023 | nodejs20 | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-debuginfo | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-debugsource | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-devel | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-docs | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-full-i18n | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-libs | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-libs-debuginfo | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.1 |
| amazon linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.11.1.1.amzn2023.0.1 |
| Oracle Linux 8 | nodejs | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-devel | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-docs | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-full-i18n | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-packaging | 2021.06-4.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-packaging-bundler | 2021.06-4.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | npm | 1:10.2.4-1.20.11.1.1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 9 | nodejs | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-devel | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | nodejs-packaging | 2021.06-4.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | nodejs-packaging-bundler | 2021.06-4.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+90254+3f4d3ee1 |
| rapidfort alma 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781, 3.0.1-1.module_el9.3.0+47+c33bc288 |
| rapidfort alma 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort amazon linux 2023 | nodejs20 | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-devel | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-docs | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-full-i18n | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-libs | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.1 |
| rapidfort Oracle Linux 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| rapidfort Oracle Linux 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| rapidfort Red Hat 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| rapidfort rocky 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort ubuntu 20.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 20.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 22.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 22.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 24.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 24.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rocky 8 | nodejs:20::nodejs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-devel | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-docs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-nodemon | 3.0.1-1.module+el8.8.0+1459+02651ab6 |
| rocky 8 | nodejs:20::nodejs-packaging | 2021.06-4.module+el8.7.0+1072+5b168780 |
| rocky 8 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module+el8.7.0+1072+5b168780 |
| rocky 8 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module+el8.9.0+1776+addd4aec |
| rocky 9 | nodejs:22::nodejs-nodemon | 3.0.1-1.module+el9.6.0+32143+ae966e5b |
| rocky 9 | nodejs:22::nodejs-packaging | 2021.06-4.module+el9.6.0+32185+bd121a25 |
| rocky 9 | nodejs:22::nodejs-packaging-bundler | 2021.06-4.module+el9.6.0+32185+bd121a25 |
Referencias
- http://www.openwall.com/lists/oss-security/2024/03/11/1
- https://access.redhat.com/errata/RHSA-2024:1688
- https://access.redhat.com/security/cve/CVE-2024-21896
- https://bugzilla.redhat.com/2264569
- https://bugzilla.redhat.com/2264574
- https://bugzilla.redhat.com/2264582
- https://bugzilla.redhat.com/2265717
- https://bugzilla.redhat.com/2265720
Las 36 referencias
- https://bugzilla.redhat.com/2265722
- https://bugzilla.redhat.com/2265727
- https://bugzilla.redhat.com/show_bug.cgi?id=2264569
- https://bugzilla.redhat.com/show_bug.cgi?id=2264574
- https://bugzilla.redhat.com/show_bug.cgi?id=2264582
- https://bugzilla.redhat.com/show_bug.cgi?id=2265717
- https://bugzilla.redhat.com/show_bug.cgi?id=2265720
- https://bugzilla.redhat.com/show_bug.cgi?id=2265722
- https://bugzilla.redhat.com/show_bug.cgi?id=2265727
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46809
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21890
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21891
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21892
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21896
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22017
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22019
- https://errata.almalinux.org/9/ALSA-2024-1688.html
- https://errata.rockylinux.org/RLSA-2024:1688
- https://github.com/nodejs/node/releases/tag/v20.11.1
- https://github.com/nodejs/node/releases/tag/v21.6.2
- https://hackerone.com/reports/2218653
- https://linux.oracle.com/cve/CVE-2024-21896.html
- https://linux.oracle.com/errata/ELSA-2024-1688.html
- https://nodejs.org/en/blog/vulnerability/february-2024-security-releases#path-traversal-by-monkey-patching-buffer-internals-cve-2024-21896---high
- https://nvd.nist.gov/vuln/detail/CVE-2024-21896
- https://security.netapp.com/advisory/ntap-20240329-0002/
- https://www.cve.org/CVERecord?id=CVE-2024-21896