Threats Tagged 'cve-2025-23085'

Red Hat OpenShift Data Foundation 4.17 security, enhancement & bug fix update.

Multiple security vulnerabilities have been identified and addressed in the Node.js 22 module for Red Hat Enterprise Linux 9. These include insufficient randomness in the undici HTTP client library (CVE-2025-22150), exposure of Node.js worker threads via the diagnostics channel (CVE-2025-23083), and a memory leak caused by GOAWAY HTTP/2 frames (CVE-2025-23085). Red Hat has released updated packages to remediate these issues.

Red Hat has issued a security advisory for Node.js 22 on Red Hat Enterprise Linux 8 addressing three vulnerabilities: insufficient randomness in the undici HTTP client (CVE-2025-22150), worker thread exposure via the diagnostics channel (CVE-2025-23083), and a memory leak caused by GOAWAY HTTP/2 frames (CVE-2025-23085). These issues have been rated with an important security impact. The advisory provides updated packages to remediate these vulnerabilities.

This advisory addresses two security vulnerabilities in Node.js 18 as packaged by Red Hat for Red Hat Enterprise Linux 8. The first vulnerability (CVE-2025-22150) involves the undici HTTP client library using insufficiently random values, which can affect cryptographic strength. The second vulnerability (CVE-2025-23085) involves a memory leak caused by GOAWAY HTTP/2 frames occurring outside the heap. Red Hat has released an update to Node.js 18 to fix these issues. The update is rated as having a moderate security impact. No CVSS scores are provided in the advisory.

This Red Hat security advisory addresses multiple vulnerabilities in Node.js 20 as packaged for Red Hat Enterprise Linux 9. The issues include insufficient randomness in the undici HTTP client library (CVE-2025-22150), exposure of Node.js worker threads via the diagnostics channel (CVE-2025-23083), and a memory leak caused by GOAWAY HTTP/2 frames (CVE-2025-23085). The update is rated as important by Red Hat Product Security. No CVSS scores are provided in the advisory. The vulnerabilities affect Node.js versions from 20.0.0 up to and including 20.18.2 as distributed by Red Hat. The advisory provides updated packages to address these issues.