VDB
GCVE-110-MAGEIA-2024-282
GCVE-110-MAGEIA-2024-282
Advisory Published
Nodejs 22 is the new active LTS branch and 5 CVE are fixed.
CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
CVE-2024-22018 - fs.lstat bypasses permission model (Low)
CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
CVE-2024-37372 - Permission model improperly processes UNC paths (Low)
yarn package is updated with npm 10.8.2
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Mageia | yarnpkg | 0 (affected), 1.22.22-0.10.8.2.1.mga9 (unaffected) | — |
| Mageia | nodejs | 0 (affected), 22.6.0-1.mga9 (unaffected) | — |
Aliases
References
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.