 |
Hi, thanks for your report! Rocky Linux's stated goal is 100% version/patch parity with the upstream RHEL (Red Hat Enterprise Linux). Once an update is issued there, the Rocky project then follows suit very quickly. I see that most of these have not yet been addressed in RHEL, like: https://access.redhat.com/security/cve/cve-2023-32002 . Others don't seem to affect the RHEL NodeJS, and therefore will also not affect the Rocky packages either, like: https://access.redhat.com/security/cve/cve-2023-32558 . Many of these CVEs seem to only affect NodeJS's experimental new security policy system. I'd speculate the lack of urgency around some of these updates is due to most enterprise customers not relying on the new system. But that's only my personal view of the situation - I don't know much about NodeJS all told. Thanks, hope this helps, - Skip |
 |
- CVE-2023-32002 - Fixed - CVE-2023-32003 - Not affected - CVE-2023-32004 - Not affected - CVE-2023-32005 - Not affected - CVE-2023-32006 - Fixed - CVE-2023-32558 - Not affected - CVE-2023-32558 - Fixed |
- Anonymous
