critique
CVE-2024-21896
nodejs: path traversal by monkey-patching buffer internals
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.9CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Azure Linux, Bitnami, Photon OS. Plus basse selon Red Hat (élevée), AlmaLinux (élevée), Amazon (élevée), Oracle (élevée), Rocky Linux (élevée).
Description
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Azure Linux 3.0 | nodejs | 0:20.14.0-1.azl3 |
| bitnami::Bitnami Vulnerability Database | node, node-min | 20.12.0, 22.1.0 et 1 autres |
| Photon OS 5.0 | nodejs, nodejs-devel | 20.11.1-1.ph5 |
| alma 8 | nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs et 5 autres | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 et 3 autres |
| alma 9 | nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs et 5 autres | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 et 3 autres |
| amazon linux 2023 | nodejs20, nodejs20-debuginfo, nodejs20-debugsource et 7 autres | 1:20.11.1-1.amzn2023.0.1 et 2 autres |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs et 5 autres | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 et 3 autres |
| Oracle Linux 9 | nodejs, nodejs-devel, nodejs-docs et 5 autres | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 et 3 autres |
| rapidfort alma 9 | nodejs, nodejs-docs, nodejs-full-i18n et 2 autres | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a et 2 autres |
| rapidfort amazon linux 2023 | nodejs20, nodejs20-devel, nodejs20-docs et 3 autres | 1:20.11.1-1.amzn2023.0.1 et 1 autres |
| rapidfort Oracle Linux 9 | nodejs, nodejs-docs, nodejs-full-i18n et 2 autres | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a et 2 autres |
| rapidfort Red Hat 9 | nodejs, nodejs-docs, nodejs-full-i18n et 2 autres | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a et 2 autres |
Afficher les 89 entrées de 18 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Azure Linux 3.0 | nodejs | 0:20.14.0-1.azl3 |
| bitnami::Bitnami Vulnerability Database | node | 20.12.0, 22.1.0 |
| bitnami::Bitnami Vulnerability Database | node-min | 20.18.1, 22.12.0 |
| Photon OS 5.0 | nodejs | 20.11.1-1.ph5 |
| Photon OS 5.0 | nodejs-devel | 20.11.1-1.ph5 |
| alma 8 | nodejs:20::nodejs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-devel | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-docs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 |
| alma 8 | nodejs:20::nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| alma 8 | nodejs:20::nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| alma 8 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| alma 8 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35 |
| alma 9 | nodejs:20::nodejs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-devel | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-docs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 |
| alma 9 | nodejs:20::nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 |
| alma 9 | nodejs:20::nodejs-packaging | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| alma 9 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+48+1cf146a1 |
| alma 9 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2 |
| amazon linux 2023 | nodejs20 | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-debuginfo | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-debugsource | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-devel | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-docs | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-full-i18n | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-libs | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-libs-debuginfo | 1:20.11.1-1.amzn2023.0.1 |
| amazon linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.1 |
| amazon linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.11.1.1.amzn2023.0.1 |
| Oracle Linux 8 | nodejs | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-devel | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-docs | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-full-i18n | 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-packaging | 2021.06-4.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-packaging-bundler | 2021.06-4.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | npm | 1:10.2.4-1.20.11.1.1.module+el8.9.0+90250+089ba5e1 |
| Oracle Linux 9 | nodejs | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-devel | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | nodejs-packaging | 2021.06-4.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | nodejs-packaging-bundler | 2021.06-4.module+el9.3.0+90066+12d4a8d7 |
| Oracle Linux 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+90254+3f4d3ee1 |
| rapidfort alma 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort alma 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781, 3.0.1-1.module_el9.3.0+47+c33bc288 |
| rapidfort alma 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort amazon linux 2023 | nodejs20 | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-devel | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-docs | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-full-i18n | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-libs | 1:20.11.1-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.1 |
| rapidfort Oracle Linux 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| rapidfort Oracle Linux 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-docs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort Red Hat 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| rapidfort Red Hat 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs-full-i18n | 1:20.11.1-1.module+el9.3.0+21385+bac43d5a |
| rapidfort rocky 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| rapidfort rocky 9 | npm | 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a |
| rapidfort ubuntu 20.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 20.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 22.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 22.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 24.04 | nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rapidfort ubuntu 24.04 | rf-nodejs | 0:22.22.1+dfsg+~cs22.19.15-1ubuntu1 |
| rocky 8 | nodejs:20::nodejs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-devel | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-docs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-full-i18n | 1:20.11.1-1.module+el8.9.0+1776+addd4aec |
| rocky 8 | nodejs:20::nodejs-nodemon | 3.0.1-1.module+el8.8.0+1459+02651ab6 |
| rocky 8 | nodejs:20::nodejs-packaging | 2021.06-4.module+el8.7.0+1072+5b168780 |
| rocky 8 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module+el8.7.0+1072+5b168780 |
| rocky 8 | nodejs:20::npm | 1:10.2.4-1.20.11.1.1.module+el8.9.0+1776+addd4aec |
| rocky 9 | nodejs:22::nodejs-nodemon | 3.0.1-1.module+el9.6.0+32143+ae966e5b |
| rocky 9 | nodejs:22::nodejs-packaging | 2021.06-4.module+el9.6.0+32185+bd121a25 |
| rocky 9 | nodejs:22::nodejs-packaging-bundler | 2021.06-4.module+el9.6.0+32185+bd121a25 |
Références
- http://www.openwall.com/lists/oss-security/2024/03/11/1
- https://access.redhat.com/errata/RHSA-2024:1688
- https://access.redhat.com/security/cve/CVE-2024-21896
- https://bugzilla.redhat.com/2264569
- https://bugzilla.redhat.com/2264574
- https://bugzilla.redhat.com/2264582
- https://bugzilla.redhat.com/2265717
- https://bugzilla.redhat.com/2265720
Les 36 références
- https://bugzilla.redhat.com/2265722
- https://bugzilla.redhat.com/2265727
- https://bugzilla.redhat.com/show_bug.cgi?id=2264569
- https://bugzilla.redhat.com/show_bug.cgi?id=2264574
- https://bugzilla.redhat.com/show_bug.cgi?id=2264582
- https://bugzilla.redhat.com/show_bug.cgi?id=2265717
- https://bugzilla.redhat.com/show_bug.cgi?id=2265720
- https://bugzilla.redhat.com/show_bug.cgi?id=2265722
- https://bugzilla.redhat.com/show_bug.cgi?id=2265727
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46809
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21890
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21891
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21892
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21896
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22017
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22019
- https://errata.almalinux.org/9/ALSA-2024-1688.html
- https://errata.rockylinux.org/RLSA-2024:1688
- https://github.com/nodejs/node/releases/tag/v20.11.1
- https://github.com/nodejs/node/releases/tag/v21.6.2
- https://hackerone.com/reports/2218653
- https://linux.oracle.com/cve/CVE-2024-21896.html
- https://linux.oracle.com/errata/ELSA-2024-1688.html
- https://nodejs.org/en/blog/vulnerability/february-2024-security-releases#path-traversal-by-monkey-patching-buffer-internals-cve-2024-21896---high
- https://nvd.nist.gov/vuln/detail/CVE-2024-21896
- https://security.netapp.com/advisory/ntap-20240329-0002/
- https://www.cve.org/CVERecord?id=CVE-2024-21896