Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / CVE-2024-21896

kritik

CVE-2024-21896

nodejs: path traversal by monkey-patching buffer internals

Yayın Değişiklik CWE 27
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.9CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Azure Linux, Bitnami, Photon OS. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Amazon (yüksek), Oracle (yüksek), Rocky Linux (yüksek).

Açıklama

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
Azure Linux 3.0nodejs0:20.14.0-1.azl3
bitnami::Bitnami Vulnerability Databasenode, node-min20.12.0, 22.1.0 ve 1 tane daha
Photon OS 5.0nodejs, nodejs-devel20.11.1-1.ph5
alma 8nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs ve 5 tane daha1:20.11.1-1.module_el8.9.0+3775+d8460d35 ve 3 tane daha
alma 9nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs ve 5 tane daha1:20.11.1-1.module_el9.3.0+88+29afeaa2 ve 3 tane daha
amazon linux 2023nodejs20, nodejs20-debuginfo, nodejs20-debugsource ve 7 tane daha1:20.11.1-1.amzn2023.0.1 ve 2 tane daha
Oracle Linux 8nodejs, nodejs-devel, nodejs-docs ve 5 tane daha1:20.11.1-1.module+el8.9.0+90250+089ba5e1 ve 3 tane daha
Oracle Linux 9nodejs, nodejs-devel, nodejs-docs ve 5 tane daha1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1 ve 3 tane daha
rapidfort alma 9nodejs, nodejs-docs, nodejs-full-i18n ve 2 tane daha1:20.11.1-1.module+el9.3.0+21385+bac43d5a ve 2 tane daha
rapidfort amazon linux 2023nodejs20, nodejs20-devel, nodejs20-docs ve 3 tane daha1:20.11.1-1.amzn2023.0.1 ve 1 tane daha
rapidfort Oracle Linux 9nodejs, nodejs-docs, nodejs-full-i18n ve 2 tane daha1:20.11.1-1.module+el9.3.0+21385+bac43d5a ve 2 tane daha
rapidfort Red Hat 9nodejs, nodejs-docs, nodejs-full-i18n ve 2 tane daha1:20.11.1-1.module+el9.3.0+21385+bac43d5a ve 2 tane daha
18 kaynaktaki 89 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
Azure Linux 3.0nodejs0:20.14.0-1.azl3
bitnami::Bitnami Vulnerability Databasenode20.12.0, 22.1.0
bitnami::Bitnami Vulnerability Databasenode-min20.18.1, 22.12.0
Photon OS 5.0nodejs20.11.1-1.ph5
Photon OS 5.0nodejs-devel20.11.1-1.ph5
alma 8nodejs:20::nodejs1:20.11.1-1.module_el8.9.0+3775+d8460d35
alma 8nodejs:20::nodejs-devel1:20.11.1-1.module_el8.9.0+3775+d8460d35
alma 8nodejs:20::nodejs-docs1:20.11.1-1.module_el8.9.0+3775+d8460d35
alma 8nodejs:20::nodejs-full-i18n1:20.11.1-1.module_el8.9.0+3775+d8460d35
alma 8nodejs:20::nodejs-nodemon3.0.1-1.module_el8.9.0+3731+490e3ce5
alma 8nodejs:20::nodejs-packaging2021.06-4.module_el8.9.0+3684+11b9e959
alma 8nodejs:20::nodejs-packaging-bundler2021.06-4.module_el8.9.0+3684+11b9e959
alma 8nodejs:20::npm1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35
alma 9nodejs:20::nodejs1:20.11.1-1.module_el9.3.0+88+29afeaa2
alma 9nodejs:20::nodejs-devel1:20.11.1-1.module_el9.3.0+88+29afeaa2
alma 9nodejs:20::nodejs-docs1:20.11.1-1.module_el9.3.0+88+29afeaa2
alma 9nodejs:20::nodejs-full-i18n1:20.11.1-1.module_el9.3.0+88+29afeaa2
alma 9nodejs:20::nodejs-nodemon3.0.1-1.module_el9.3.0+47+c33bc288
alma 9nodejs:20::nodejs-packaging2021.06-4.module_el9.3.0+48+1cf146a1
alma 9nodejs:20::nodejs-packaging-bundler2021.06-4.module_el9.3.0+48+1cf146a1
alma 9nodejs:20::npm1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2
amazon linux 2023nodejs201:20.11.1-1.amzn2023.0.1
amazon linux 2023nodejs20-debuginfo1:20.11.1-1.amzn2023.0.1
amazon linux 2023nodejs20-debugsource1:20.11.1-1.amzn2023.0.1
amazon linux 2023nodejs20-devel1:20.11.1-1.amzn2023.0.1
amazon linux 2023nodejs20-docs1:20.11.1-1.amzn2023.0.1
amazon linux 2023nodejs20-full-i18n1:20.11.1-1.amzn2023.0.1
amazon linux 2023nodejs20-libs1:20.11.1-1.amzn2023.0.1
amazon linux 2023nodejs20-libs-debuginfo1:20.11.1-1.amzn2023.0.1
amazon linux 2023nodejs20-npm1:10.2.4-1.20.11.1.1.amzn2023.0.1
amazon linux 2023v8-11.3-devel3:11.3.244.8-1.20.11.1.1.amzn2023.0.1
Oracle Linux 8nodejs1:20.11.1-1.module+el8.9.0+90250+089ba5e1
Oracle Linux 8nodejs-devel1:20.11.1-1.module+el8.9.0+90250+089ba5e1
Oracle Linux 8nodejs-docs1:20.11.1-1.module+el8.9.0+90250+089ba5e1
Oracle Linux 8nodejs-full-i18n1:20.11.1-1.module+el8.9.0+90250+089ba5e1
Oracle Linux 8nodejs-nodemon3.0.1-1.module+el8.9.0+90082+b6a613a6
Oracle Linux 8nodejs-packaging2021.06-4.module+el8.9.0+90082+b6a613a6
Oracle Linux 8nodejs-packaging-bundler2021.06-4.module+el8.9.0+90082+b6a613a6
Oracle Linux 8npm1:10.2.4-1.20.11.1.1.module+el8.9.0+90250+089ba5e1
Oracle Linux 9nodejs1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1
Oracle Linux 9nodejs-devel1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1
Oracle Linux 9nodejs-docs1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1
Oracle Linux 9nodejs-full-i18n1:20.11.1-1.module+el9.3.0+90254+3f4d3ee1
Oracle Linux 9nodejs-nodemon3.0.1-1.module+el9.3.0+90066+12d4a8d7
Oracle Linux 9nodejs-packaging2021.06-4.module+el9.3.0+90066+12d4a8d7
Oracle Linux 9nodejs-packaging-bundler2021.06-4.module+el9.3.0+90066+12d4a8d7
Oracle Linux 9npm1:10.2.4-1.20.11.1.1.module+el9.3.0+90254+3f4d3ee1
rapidfort alma 9nodejs1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort alma 9nodejs-docs1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort alma 9nodejs-full-i18n1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort alma 9nodejs-nodemon0:3.0.1-1.module+el9.3.0.z+20478+84a9f781, 3.0.1-1.module_el9.3.0+47+c33bc288
rapidfort alma 9npm1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a
rapidfort amazon linux 2023nodejs201:20.11.1-1.amzn2023.0.1
rapidfort amazon linux 2023nodejs20-devel1:20.11.1-1.amzn2023.0.1
rapidfort amazon linux 2023nodejs20-docs1:20.11.1-1.amzn2023.0.1
rapidfort amazon linux 2023nodejs20-full-i18n1:20.11.1-1.amzn2023.0.1
rapidfort amazon linux 2023nodejs20-libs1:20.11.1-1.amzn2023.0.1
rapidfort amazon linux 2023nodejs20-npm1:10.2.4-1.20.11.1.1.amzn2023.0.1
rapidfort Oracle Linux 9nodejs1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort Oracle Linux 9nodejs-docs1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort Oracle Linux 9nodejs-full-i18n1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort Oracle Linux 9nodejs-nodemon0:3.0.1-1.module+el9.3.0.z+20478+84a9f781
rapidfort Oracle Linux 9npm1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a
rapidfort Red Hat 9nodejs1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort Red Hat 9nodejs-docs1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort Red Hat 9nodejs-full-i18n1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort Red Hat 9nodejs-nodemon0:3.0.1-1.module+el9.3.0.z+20478+84a9f781
rapidfort Red Hat 9npm1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a
rapidfort rocky 9nodejs1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort rocky 9nodejs-full-i18n1:20.11.1-1.module+el9.3.0+21385+bac43d5a
rapidfort rocky 9nodejs-nodemon0:3.0.1-1.module+el9.6.0+32185+bd121a25
rapidfort rocky 9npm1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a
rapidfort ubuntu 20.04nodejs0:22.22.1+dfsg+~cs22.19.15-1ubuntu1
rapidfort ubuntu 20.04rf-nodejs0:22.22.1+dfsg+~cs22.19.15-1ubuntu1
rapidfort ubuntu 22.04nodejs0:22.22.1+dfsg+~cs22.19.15-1ubuntu1
rapidfort ubuntu 22.04rf-nodejs0:22.22.1+dfsg+~cs22.19.15-1ubuntu1
rapidfort ubuntu 24.04nodejs0:22.22.1+dfsg+~cs22.19.15-1ubuntu1
rapidfort ubuntu 24.04rf-nodejs0:22.22.1+dfsg+~cs22.19.15-1ubuntu1
rocky 8nodejs:20::nodejs1:20.11.1-1.module+el8.9.0+1776+addd4aec
rocky 8nodejs:20::nodejs-devel1:20.11.1-1.module+el8.9.0+1776+addd4aec
rocky 8nodejs:20::nodejs-docs1:20.11.1-1.module+el8.9.0+1776+addd4aec
rocky 8nodejs:20::nodejs-full-i18n1:20.11.1-1.module+el8.9.0+1776+addd4aec
rocky 8nodejs:20::nodejs-nodemon3.0.1-1.module+el8.8.0+1459+02651ab6
rocky 8nodejs:20::nodejs-packaging2021.06-4.module+el8.7.0+1072+5b168780
rocky 8nodejs:20::nodejs-packaging-bundler2021.06-4.module+el8.7.0+1072+5b168780
rocky 8nodejs:20::npm1:10.2.4-1.20.11.1.1.module+el8.9.0+1776+addd4aec
rocky 9nodejs:22::nodejs-nodemon3.0.1-1.module+el9.6.0+32143+ae966e5b
rocky 9nodejs:22::nodejs-packaging2021.06-4.module+el9.6.0+32185+bd121a25
rocky 9nodejs:22::nodejs-packaging-bundler2021.06-4.module+el9.6.0+32185+bd121a25

Referanslar

36 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.