MGASA-2024-0282

Advisory lineage Upstream: 5 Downstream: 0
Published: 28 Aug 2024, 17:11
Last modified:16 Apr 2026, 04:21

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Aug 2024, 17:11
Published
Vulnerability first disclosed
16 Apr 2026, 04:21
Last Modified
Vulnerability information updated

Description

Updated nodejs & yarnpkg packages fix security vulnerabilities Nodejs 22 is the new active LTS branch and 5 CVE are fixed. CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) CVE-2024-22020 - Bypass network import restriction via data URL (Medium) CVE-2024-22018 - fs.lstat bypasses permission model (Low) CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low) CVE-2024-37372 - Permission model improperly processes UNC paths (Low) yarn package is updated with npm 10.8.2

Affected Systems

  • mageia•nodejs

    < 22.6.0-1.mga9

  • mageia•yarnpkg

    < 1.22.22-0.10.8.2.1.mga9

References (11)