0

I have installed nodejs package (version 18.16.1-deb-1nodesource1) on Ubuntu 22.04. Trivy vulnerability scan identified CVE-2021-3449. It is related to OpenSSL version 1.1.1 to 1.1.1j. But the OpenSSL version installed on Ubuntu is 3. How can we fix this CVE so that it won't come up in Trivy scan?

Improve this question
5
  • 2
    Ask whoever sold the broken CVE scanner to you to fix it
    – muru
    Jun 26 at 3:42
  • ubuntu.com/security/cves?q=CVE-2021-3449 & ubuntu.com/security/CVE-2021-3449
    – guiverc
    Jun 26 at 3:46
  • 2
    On closer inspection, nodejs on Ubuntu 22.04 is at 12.22.9~dfsg-1ubuntu3, which is nothing like the version you have specified. It seems you got it from somewhere other than the official repositories. In that case, ask the source of this package to fix it.
    – muru
    Jun 26 at 4:05
  • I think you might be referring to Node 12 version. I have installed the node 18 from NodeSources from github.com/nodesource/distributions. For Node 18, 18.16.1 is the latest version.
    – noonenine
    Jun 26 at 4:43
  • 1
    @noonenine so that's not from Ubuntu, now is it? You should be asking nodesource for the patched release.
    – muru
    Jun 26 at 5:05

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .