{ "document": { "aggregate_severity": { "text": "High" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_nodejs/el10/vex/2022/cve-2022-32223-els_alt_nodejs-el10.json" } ], "tracking": { "current_release_date": "2026-03-03T21:07:45Z", "generator": { "date": "2026-03-03T21:07:45Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2022-32223-ELS_ALT_NODEJS-EL10", "initial_release_date": "2022-07-14T15:15:00Z", "revision_history": [ { "date": "2022-07-14T15:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-03-03T21:07:45Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2022-32223" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 9", "product": { "name": "Community Enterprise Operating System 9", "product_id": "CentOS-10", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:10:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-nodejs14-nodejs-devel-0:14.21.3-16.el10.x86_64", "product": { "name": "alt-nodejs14-nodejs-devel-0:14.21.3-16.el10.x86_64", "product_id": "alt-nodejs14-nodejs-devel-0:14.21.3-16.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs-devel@14.21.3-16.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs14-nodejs-devel-0:14.21.3-19.el10.x86_64", "product": { "name": "alt-nodejs14-nodejs-devel-0:14.21.3-19.el10.x86_64", "product_id": "alt-nodejs14-nodejs-devel-0:14.21.3-19.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs-devel@14.21.3-19.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.16.el10.x86_64", "product": { "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.16.el10.x86_64", "product_id": "alt-nodejs14-npm-1:6.14.18-14.21.3.16.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-npm@6.14.18-14.21.3.16.el10?arch=x86_64&epoch=1&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.19.el10.x86_64", "product": { "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.19.el10.x86_64", "product_id": "alt-nodejs14-npm-1:6.14.18-14.21.3.19.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-npm@6.14.18-14.21.3.19.el10?arch=x86_64&epoch=1&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs14-nodejs-0:14.21.3-19.el10.x86_64", "product": { "name": "alt-nodejs14-nodejs-0:14.21.3-19.el10.x86_64", "product_id": "alt-nodejs14-nodejs-0:14.21.3-19.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs@14.21.3-19.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs14-nodejs-0:14.21.3-16.el10.x86_64", "product": { "name": "alt-nodejs14-nodejs-0:14.21.3-16.el10.x86_64", "product_id": "alt-nodejs14-nodejs-0:14.21.3-16.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs@14.21.3-16.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs16-nodejs-0:16.20.2-12.el10.x86_64", "product": { "name": "alt-nodejs16-nodejs-0:16.20.2-12.el10.x86_64", "product_id": "alt-nodejs16-nodejs-0:16.20.2-12.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs16-nodejs@16.20.2-12.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs16-nodejs-0:16.20.2-10.el10.x86_64", "product": { "name": "alt-nodejs16-nodejs-0:16.20.2-10.el10.x86_64", "product_id": "alt-nodejs16-nodejs-0:16.20.2-10.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs16-nodejs@16.20.2-10.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs16-npm-0:8.19.4-16.20.2.12.el10.x86_64", "product": { "name": "alt-nodejs16-npm-0:8.19.4-16.20.2.12.el10.x86_64", "product_id": "alt-nodejs16-npm-0:8.19.4-16.20.2.12.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs16-npm@8.19.4-16.20.2.12.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs16-npm-0:8.19.4-16.20.2.10.el10.x86_64", "product": { "name": "alt-nodejs16-npm-0:8.19.4-16.20.2.10.el10.x86_64", "product_id": "alt-nodejs16-npm-0:8.19.4-16.20.2.10.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs16-npm@8.19.4-16.20.2.10.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs16-nodejs-devel-0:16.20.2-12.el10.x86_64", "product": { "name": "alt-nodejs16-nodejs-devel-0:16.20.2-12.el10.x86_64", "product_id": "alt-nodejs16-nodejs-devel-0:16.20.2-12.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs16-nodejs-devel@16.20.2-12.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs16-nodejs-devel-0:16.20.2-10.el10.x86_64", "product": { "name": "alt-nodejs16-nodejs-devel-0:16.20.2-10.el10.x86_64", "product_id": "alt-nodejs16-nodejs-devel-0:16.20.2-10.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs16-nodejs-devel@16.20.2-10.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.5.el10.x86_64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.5.el10.x86_64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.5.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.5.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.4.el10.x86_64", "product": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.4.el10.x86_64", "product_id": "alt-nodejs18-npm-0:10.8.2-18.20.8.4.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs18-npm@10.8.2-18.20.8.4.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-5.el10.x86_64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-5.el10.x86_64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-5.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-5.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-devel-0:18.20.8-4.el10.x86_64", "product": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-4.el10.x86_64", "product_id": "alt-nodejs18-nodejs-devel-0:18.20.8-4.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs18-nodejs-devel@18.20.8-4.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-5.el10.x86_64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-5.el10.x86_64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-5.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs18-nodejs@18.20.8-5.el10?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-0:18.20.8-4.el10.x86_64", "product": { "name": "alt-nodejs18-nodejs-0:18.20.8-4.el10.x86_64", "product_id": "alt-nodejs18-nodejs-0:18.20.8-4.el10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs18-nodejs@18.20.8-4.el10?arch=x86_64&os_name=centos&os_version=9" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "alt-nodejs14-nodejs-docs-0:14.21.3-19.el10.noarch", "product": { "name": "alt-nodejs14-nodejs-docs-0:14.21.3-19.el10.noarch", "product_id": "alt-nodejs14-nodejs-docs-0:14.21.3-19.el10.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs-docs@14.21.3-19.el10?arch=noarch&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs14-nodejs-docs-0:14.21.3-16.el10.noarch", "product": { "name": "alt-nodejs14-nodejs-docs-0:14.21.3-16.el10.noarch", "product_id": "alt-nodejs14-nodejs-docs-0:14.21.3-16.el10.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs-docs@14.21.3-16.el10?arch=noarch&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs16-nodejs-docs-0:16.20.2-10.el10.noarch", "product": { "name": "alt-nodejs16-nodejs-docs-0:16.20.2-10.el10.noarch", "product_id": "alt-nodejs16-nodejs-docs-0:16.20.2-10.el10.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs16-nodejs-docs@16.20.2-10.el10?arch=noarch&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs16-nodejs-docs-0:16.20.2-12.el10.noarch", "product": { "name": "alt-nodejs16-nodejs-docs-0:16.20.2-12.el10.noarch", "product_id": "alt-nodejs16-nodejs-docs-0:16.20.2-12.el10.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs16-nodejs-docs@16.20.2-12.el10?arch=noarch&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-docs-0:18.20.8-5.el10.noarch", "product": { "name": "alt-nodejs18-nodejs-docs-0:18.20.8-5.el10.noarch", "product_id": "alt-nodejs18-nodejs-docs-0:18.20.8-5.el10.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs18-nodejs-docs@18.20.8-5.el10?arch=noarch&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-nodejs18-nodejs-docs-0:18.20.8-4.el10.noarch", "product": { "name": "alt-nodejs18-nodejs-docs-0:18.20.8-4.el10.noarch", "product_id": "alt-nodejs18-nodejs-docs-0:18.20.8-4.el10.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs18-nodejs-docs@18.20.8-4.el10?arch=noarch&os_name=centos&os_version=9" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-devel-0:14.21.3-16.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs14-nodejs-devel-0:14.21.3-16.el10.x86_64" }, "product_reference": "alt-nodejs14-nodejs-devel-0:14.21.3-16.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-devel-0:14.21.3-19.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs14-nodejs-devel-0:14.21.3-19.el10.x86_64" }, "product_reference": "alt-nodejs14-nodejs-devel-0:14.21.3-19.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.16.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs14-npm-1:6.14.18-14.21.3.16.el10.x86_64" }, "product_reference": "alt-nodejs14-npm-1:6.14.18-14.21.3.16.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.19.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs14-npm-1:6.14.18-14.21.3.19.el10.x86_64" }, "product_reference": "alt-nodejs14-npm-1:6.14.18-14.21.3.19.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-0:14.21.3-19.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs14-nodejs-0:14.21.3-19.el10.x86_64" }, "product_reference": "alt-nodejs14-nodejs-0:14.21.3-19.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-0:14.21.3-16.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs14-nodejs-0:14.21.3-16.el10.x86_64" }, "product_reference": "alt-nodejs14-nodejs-0:14.21.3-16.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-docs-0:14.21.3-19.el10.noarch as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs14-nodejs-docs-0:14.21.3-19.el10.noarch" }, "product_reference": "alt-nodejs14-nodejs-docs-0:14.21.3-19.el10.noarch", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-docs-0:14.21.3-16.el10.noarch as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs14-nodejs-docs-0:14.21.3-16.el10.noarch" }, "product_reference": "alt-nodejs14-nodejs-docs-0:14.21.3-16.el10.noarch", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-nodejs-docs-0:16.20.2-10.el10.noarch as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs16-nodejs-docs-0:16.20.2-10.el10.noarch" }, "product_reference": "alt-nodejs16-nodejs-docs-0:16.20.2-10.el10.noarch", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-nodejs-docs-0:16.20.2-12.el10.noarch as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs16-nodejs-docs-0:16.20.2-12.el10.noarch" }, "product_reference": "alt-nodejs16-nodejs-docs-0:16.20.2-12.el10.noarch", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-nodejs-0:16.20.2-12.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs16-nodejs-0:16.20.2-12.el10.x86_64" }, "product_reference": "alt-nodejs16-nodejs-0:16.20.2-12.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-nodejs-0:16.20.2-10.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs16-nodejs-0:16.20.2-10.el10.x86_64" }, "product_reference": "alt-nodejs16-nodejs-0:16.20.2-10.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-npm-0:8.19.4-16.20.2.12.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs16-npm-0:8.19.4-16.20.2.12.el10.x86_64" }, "product_reference": "alt-nodejs16-npm-0:8.19.4-16.20.2.12.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-npm-0:8.19.4-16.20.2.10.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs16-npm-0:8.19.4-16.20.2.10.el10.x86_64" }, "product_reference": "alt-nodejs16-npm-0:8.19.4-16.20.2.10.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-nodejs-devel-0:16.20.2-12.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs16-nodejs-devel-0:16.20.2-12.el10.x86_64" }, "product_reference": "alt-nodejs16-nodejs-devel-0:16.20.2-12.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-nodejs-devel-0:16.20.2-10.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs16-nodejs-devel-0:16.20.2-10.el10.x86_64" }, "product_reference": "alt-nodejs16-nodejs-devel-0:16.20.2-10.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.5.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs18-npm-0:10.8.2-18.20.8.5.el10.x86_64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.5.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-0:10.8.2-18.20.8.4.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs18-npm-0:10.8.2-18.20.8.4.el10.x86_64" }, "product_reference": "alt-nodejs18-npm-0:10.8.2-18.20.8.4.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-docs-0:18.20.8-5.el10.noarch as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs18-nodejs-docs-0:18.20.8-5.el10.noarch" }, "product_reference": "alt-nodejs18-nodejs-docs-0:18.20.8-5.el10.noarch", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-docs-0:18.20.8-4.el10.noarch as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs18-nodejs-docs-0:18.20.8-4.el10.noarch" }, "product_reference": "alt-nodejs18-nodejs-docs-0:18.20.8-4.el10.noarch", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-5.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs18-nodejs-devel-0:18.20.8-5.el10.x86_64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-5.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-devel-0:18.20.8-4.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs18-nodejs-devel-0:18.20.8-4.el10.x86_64" }, "product_reference": "alt-nodejs18-nodejs-devel-0:18.20.8-4.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-5.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs18-nodejs-0:18.20.8-5.el10.x86_64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-5.el10.x86_64", "relates_to_product_reference": "CentOS-10" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-nodejs-0:18.20.8-4.el10.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-10:alt-nodejs18-nodejs-0:18.20.8-4.el10.x86_64" }, "product_reference": "alt-nodejs18-nodejs-0:18.20.8-4.el10.x86_64", "relates_to_product_reference": "CentOS-10" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-32223", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "notes": [ { "category": "description", "text": "Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "known_not_affected": [ "CentOS-10:alt-nodejs14-nodejs-0:14.21.3-16.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-0:14.21.3-19.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-devel-0:14.21.3-16.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-devel-0:14.21.3-19.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-docs-0:14.21.3-16.el10.noarch", "CentOS-10:alt-nodejs14-nodejs-docs-0:14.21.3-19.el10.noarch", "CentOS-10:alt-nodejs14-npm-1:6.14.18-14.21.3.16.el10.x86_64", "CentOS-10:alt-nodejs14-npm-1:6.14.18-14.21.3.19.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-0:16.20.2-10.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-0:16.20.2-12.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-devel-0:16.20.2-10.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-devel-0:16.20.2-12.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-docs-0:16.20.2-10.el10.noarch", "CentOS-10:alt-nodejs16-nodejs-docs-0:16.20.2-12.el10.noarch", "CentOS-10:alt-nodejs16-npm-0:8.19.4-16.20.2.10.el10.x86_64", "CentOS-10:alt-nodejs16-npm-0:8.19.4-16.20.2.12.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-0:18.20.8-4.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-0:18.20.8-5.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-devel-0:18.20.8-4.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-devel-0:18.20.8-5.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-docs-0:18.20.8-4.el10.noarch", "CentOS-10:alt-nodejs18-nodejs-docs-0:18.20.8-5.el10.noarch", "CentOS-10:alt-nodejs18-npm-0:10.8.2-18.20.8.4.el10.x86_64", "CentOS-10:alt-nodejs18-npm-0:10.8.2-18.20.8.5.el10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-lang/cve/CVE-2022-32223" }, { "category": "external", "summary": "https://hackerone.com/reports/1447455", "url": "https://hackerone.com/reports/1447455" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20220915-0001/", "url": "https://security.netapp.com/advisory/ntap-20220915-0001/" } ], "release_date": "2022-07-14T15:15:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-10:alt-nodejs14-nodejs-0:14.21.3-16.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-0:14.21.3-19.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-devel-0:14.21.3-16.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-devel-0:14.21.3-19.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-docs-0:14.21.3-16.el10.noarch", "CentOS-10:alt-nodejs14-nodejs-docs-0:14.21.3-19.el10.noarch", "CentOS-10:alt-nodejs14-npm-1:6.14.18-14.21.3.16.el10.x86_64", "CentOS-10:alt-nodejs14-npm-1:6.14.18-14.21.3.19.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-0:16.20.2-10.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-0:16.20.2-12.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-devel-0:16.20.2-10.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-devel-0:16.20.2-12.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-docs-0:16.20.2-10.el10.noarch", "CentOS-10:alt-nodejs16-nodejs-docs-0:16.20.2-12.el10.noarch", "CentOS-10:alt-nodejs16-npm-0:8.19.4-16.20.2.10.el10.x86_64", "CentOS-10:alt-nodejs16-npm-0:8.19.4-16.20.2.12.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-0:18.20.8-4.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-0:18.20.8-5.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-devel-0:18.20.8-4.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-devel-0:18.20.8-5.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-docs-0:18.20.8-4.el10.noarch", "CentOS-10:alt-nodejs18-nodejs-docs-0:18.20.8-5.el10.noarch", "CentOS-10:alt-nodejs18-npm-0:10.8.2-18.20.8.4.el10.x86_64", "CentOS-10:alt-nodejs18-npm-0:10.8.2-18.20.8.5.el10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" }, { "category": "impact", "details": "Not vulnerable — CVE-2022-32223 is a Windows‑specific DLL search‑order hijack in node.exe that only triggers when OpenSSL is installed and the Windows path C:\\Program Files\\Common Files\\SSL\\openssl.cnf exists. Linux platforms do not use Windows DLL loading semantics or that path, so the providers.dll search never occurs and the vulnerable code path is unreachable. Consequently, Linux‑based deployments of Node.js 14 are not affected by this issue.", "product_ids": [ "CentOS-10:alt-nodejs14-nodejs-0:14.21.3-16.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-0:14.21.3-19.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-devel-0:14.21.3-16.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-devel-0:14.21.3-19.el10.x86_64", "CentOS-10:alt-nodejs14-nodejs-docs-0:14.21.3-16.el10.noarch", "CentOS-10:alt-nodejs14-nodejs-docs-0:14.21.3-19.el10.noarch", "CentOS-10:alt-nodejs14-npm-1:6.14.18-14.21.3.16.el10.x86_64", "CentOS-10:alt-nodejs14-npm-1:6.14.18-14.21.3.19.el10.x86_64" ] }, { "category": "impact", "details": "Not vulnerable. CVE-2022-32223 is a Windows‑only DLL search‑order issue in node.exe that triggers when OpenSSL is installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists, causing a lookup for providers.dll; Linux builds of Node.js (including the alt-nodejs12 package) do not use node.exe or Windows DLL loading semantics, so the affected code path does not exist. As the deployment target is Linux VMs/servers, the prerequisite Windows conditions are not present and the vulnerability is inapplicable.", "product_ids": [ "CentOS-10:alt-nodejs16-nodejs-0:16.20.2-10.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-0:16.20.2-12.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-devel-0:16.20.2-10.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-devel-0:16.20.2-12.el10.x86_64", "CentOS-10:alt-nodejs16-nodejs-docs-0:16.20.2-10.el10.noarch", "CentOS-10:alt-nodejs16-nodejs-docs-0:16.20.2-12.el10.noarch", "CentOS-10:alt-nodejs16-npm-0:8.19.4-16.20.2.10.el10.x86_64", "CentOS-10:alt-nodejs16-npm-0:8.19.4-16.20.2.12.el10.x86_64" ] }, { "category": "impact", "details": "Not vulnerable: CVE-2022-32223 is a Windows‑specific DLL hijacking issue in node.exe that is only exploitable when OpenSSL is installed and the file C:\\Program Files\\Common Files\\SSL\\openssl.cnf exists, allowing Windows’ DLL search order to load a rogue providers.dll. The described environment runs Node.js on Linux servers/VMs, which do not use the Windows DLL search mechanism or load .dll files, so the vulnerable code path is not present or reachable. Therefore, Node.js 18 deployments on Linux are not affected by this CVE.", "product_ids": [ "CentOS-10:alt-nodejs18-nodejs-0:18.20.8-4.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-0:18.20.8-5.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-devel-0:18.20.8-4.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-devel-0:18.20.8-5.el10.x86_64", "CentOS-10:alt-nodejs18-nodejs-docs-0:18.20.8-4.el10.noarch", "CentOS-10:alt-nodejs18-nodejs-docs-0:18.20.8-5.el10.noarch", "CentOS-10:alt-nodejs18-npm-0:10.8.2-18.20.8.4.el10.x86_64", "CentOS-10:alt-nodejs18-npm-0:10.8.2-18.20.8.5.el10.x86_64" ] } ] } ] }