跳转到帖子

Rocky Linux: CVE-2025-23083: nodejs-20 (Multiple Advisories)

recommended_posts

发布于
  • Members

Rocky Linux: CVE-2025-23083: nodejs-20 (Multiple Advisories)

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
01/22/2025
Created
02/15/2025
Added
02/14/2025
Modified
02/14/2025

Description

With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.

Solution(s)

  • rocky-upgrade-nodejs
  • rocky-upgrade-nodejs-debuginfo
  • rocky-upgrade-nodejs-debugsource
  • rocky-upgrade-nodejs-devel
  • rocky-upgrade-nodejs-full-i18n
  • rocky-upgrade-npm

References

  • https://attackerkb.com/topics/cve-2025-23083
  • CVE - 2025-23083
  • https://errata.rockylinux.org/RLSA-2025:1351
  • https://errata.rockylinux.org/RLSA-2025:1443
  • 查看数 704
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…