In one of our server with 20.04.2 LTS (Focal Fossa) Qualys is detecting NodeJS version 18 at following locations & CVEs related to this are mentioned below
Location of node detected by Qualys:
/bin/node /var/snap/docker/common/var-lib-docker/overlay2/l/AUEWL7ZTSH2IAY5JMTMLSX7LEA/usr/local/bin/node js/v18.0.0
Multiple Vulnerabilities are reported in Node.JS 20 and 21
CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium
CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
Affected Versions:
Node.js version 20.X series prior to version 20.11.1
Node.js version 18.X series prior to version 18.19.1
Node.js version 21.X series prior to version 21.6.2
ubuntu@ip-:~$ node -v v22.4.0
ubuntu@ip-:~$ nodejs -v v10.19.0 ubuntu@ip-2:~$ docker info Client: Docker Engine - Community Version: 26.1.4 Context: default Debug Mode: false Plugins: buildx: Docker Buildx (Docker Inc.) Version: v0.14.1 Path: /usr/libexec/docker/cli-plugins/docker-buildx compose: Docker Compose (Docker Inc.) Version: v2.27.1 Path: /usr/libexec/docker/cli-plugins/docker-compose scan: Docker Scan (Docker Inc.) Version: v0.8.0 Path: /usr/libexec/docker/cli-plugins/docker-scan
How can we fix above issue in snap running Ubuntu 20.04.2 LTS?? Anyone fixed this issue, please suggest on this.