Mehrere Probleme in nodejs12
ID: | SUSE-SU-2021:2327-1 |
Distribution: | SUSE |
Plattformen: | SUSE Linux Enterprise Module for Web Scripting 15-SP2, SUSE Linux Enterprise Module for Web Scripting 15-SP3 |
Datum: | Mi, 14. Juli 2021, 23:00 |
Referenzen: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23362
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27290 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3450 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7774 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3449 |
Applikationen: | node.js |
Originalnachricht |
|
SUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:2327-1 Rating: important References: #1183851 #1183852 #1184450 #1187973 #1187976 #1187977 Cross-References: CVE-2020-7774 CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 CVE-2021-3449 CVE-2021-3450 CVSS scores: CVE-2020-7774 (NVD) : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-23362 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-23362 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-27290 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-27290 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3449 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3449 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3450 (NVD) : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-3450 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise Module for Web Scripting 15-SP3 SUSE Linux Enterprise Module for Web Scripting 15-SP2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: - update to 12.22.2: - CVE-2021-22918: Out of bounds read (bsc#1187973) - CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977) - CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976) - CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851) - CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852) - CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Web Scripting 15-SP3: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2021-2327=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP2: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP2-2021-2327=1 Package List: - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.2-4.16.1 nodejs12-debuginfo-12.22.2-4.16.1 nodejs12-debugsource-12.22.2-4.16.1 nodejs12-devel-12.22.2-4.16.1 npm12-12.22.2-4.16.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (noarch): nodejs12-docs-12.22.2-4.16.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP2 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.2-4.16.1 nodejs12-debuginfo-12.22.2-4.16.1 nodejs12-debugsource-12.22.2-4.16.1 nodejs12-devel-12.22.2-4.16.1 npm12-12.22.2-4.16.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP2 (noarch): nodejs12-docs-12.22.2-4.16.1 References: https://www.suse.com/security/cve/CVE-2020-7774.html https://www.suse.com/security/cve/CVE-2021-22918.html https://www.suse.com/security/cve/CVE-2021-23362.html https://www.suse.com/security/cve/CVE-2021-27290.html https://www.suse.com/security/cve/CVE-2021-3449.html https://www.suse.com/security/cve/CVE-2021-3450.html https://bugzilla.suse.com/1183851 https://bugzilla.suse.com/1183852 https://bugzilla.suse.com/1184450 https://bugzilla.suse.com/1187973 https://bugzilla.suse.com/1187976 https://bugzilla.suse.com/1187977 |