SUSE-SU-2023:0419-1: moderate: Security update for nodejs18
SUSE Security Update: Security update for nodejs18
______________________________________________________________________________
Announcement ID: SUSE-SU-2023:0419-1
Rating: moderate
References: #1200303 #1201325 #1201326 #1201327 #1201328 #1203831 #1203832 #1205042 #1205119 #1205236 PED-2097 PED-3192
Cross-References: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215 CVE-2022-35255 CVE-2022-35256 CVE-2022-43548
CVSS scores:
CVE-2022-32212 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-32212 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-32213 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVE-2022-32213 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
CVE-2022-32214 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVE-2022-32214 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVE-2022-32215 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVE-2022-32215 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVE-2022-35255 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE-2022-35255 (SUSE): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVE-2022-35256 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVE-2022-35256 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVE-2022-43548 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-43548 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products:
SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Web Scripting 15-SP4 SUSE Linux Enterprise Server 15-SP4
SUSE Linux Enterprise Server for SAP Applications 15-SP4SUSE Manager Proxy 4.3
SUSE Manager Retail Branch Server 4.3
SUSE Manager Server 4.3
openSUSE Leap 15.4
openSUSE Leap 15.5
______________________________________________________________________________
An update that solves 7 vulnerabilities, contains two
features and has three fixes is now available.
Description:
This update for nodejs18 fixes the following issues:
This update ships nodejs18 (jsc#PED-2097)
Update to NodejJS 18.13.0 LTS:
* build: disable v8 snapshot compression by default
* crypto: update root certificates
* deps: update ICU to 72.1
* doc:
+ add doc-only deprecation for headers/trailers setters + add Rafael to the tsc
+ deprecate use of invalid ports in url.parse
+ deprecate url.parse()
* lib: drop fetch experimental warning
* net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options * src:
+ add uvwasi version
+ add initial shadow realm support
* test_runner:
+ add t.after() hook
+ don't use a symbol for runHook()
* tls:
+ add "ca" property to certificate object
* util:
+ add fast path for utf8 encoding
+ improve textdecoder decode performance
+ add MIME utilities
- Fixes compatibility with ICU 72.1 (bsc#1205236)
- Fix migration to openssl-3 (bsc#1205042)
Update to NodeJS 18.12.1 LTS:
* inspector: DNS rebinding in --inspect via invalid octal IP (bsc#1205119,
CVE-2022-43548)
Update to NodeJS 18.12.0 LTS:
* Running in 'watch' mode using node --watch restarts the process when animported file is changed.
* fs: add FileHandle.prototype.readLines
* http: add writeEarlyHints function to ServerResponse
* http2: make early hints generic
* util: add default value option to parsearg
Update to NodeJS 18.11.0:
* added experimental watch mode -- running in 'watch' mode using node --watch restarts the process when an imported file is changed * fs: add FileHandle.prototype.readLines
* http: add writeEarlyHints function to ServerResponse
* http2: make early hints generic
* lib: refactor transferable AbortSignal
* src: add detailed embedder process initialization API
* util: add default value option to parsearg
Update to NodeJS 18.10.0:
* deps: upgrade npm to 8.19.2
* http: throw error on content-length mismatch
* stream: add ReadableByteStream.tee()
Update to Nodejs 18.9.1:
* deps: llhttp updated to 6.0.10
+ CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325) + Incorrect Parsing of Multi-line Transfer-Encoding (CVE-2022-32215, bsc#1201327)
+ Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)
* crypto: fix weak randomness in WebCrypto keygen (CVE-2022-35255, bsc#1203831)
Update to Nodejs 18.9.0:
* lib - add diagnostics channel for process and worker
* os - add machine method
* report - expose report public native apis
* src - expose environment RequestInterrupt api
* vm - include vm context in the embedded snapshot
Changes in 18.8.0:
* bootstrap: implement run-time user-land snapshots via
--build-snapshot and --snapshot-blob. See
* crypto:
+ allow zero-length IKM in HKDF and in webcrypto PBKDF2 + allow zero-length secret KeyObject
* deps: upgrade npm to 8.18.0
* http: make idle http parser count configurable
* net: add local family
* src: print source map error source on demand
* tls: pass a valid socket on tlsClientError
Update to Nodejs 18.7.0:
* events: add CustomEvent
* http: add drop request event for http server
* lib: improved diagnostics_channel subscribe/unsubscribe * util: add tokens to parseArgs
- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)
Update to Nodejs 18.6.0:
* Experimental ESM Loader Hooks API. For details see,
https://nodejs.org/api/esm.html
* dns: export error code constants from dns/promises
* esm: add chaining to loaders
* http: add diagnostics channel for http client
* http: add perf_hooks detail for http request and client * module: add isBuiltIn method
* net: add drop event for net server
* test_runner: expose describe and it
* v8: add v8.startupSnapshot utils
For details, see
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18
.6.0
Update to Nodejs 18.5.0:
* http: stricter Transfer-Encoding and header separator parsing (bsc#1201325, bsc#1201326, bsc#1201327, CVE-2022-32213, CVE-2022-32214,CVE-2022-32215)
* src: fix IPv4 validation in inspector_socket (bsc#1201328, CVE-2022-32212)
For details, see
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18
.5.0
Update to Nodejs 18.4.0. For detailed changes see,
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18
.4.0
Initial packaging of Nodejs 18.2.0. For detailed changes since previous versions, see
https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V18.md#
18.2.0
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.5:
zypper in -t patch openSUSE-SLE-15.5-2023-419=1
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2023-419=1
- SUSE Linux Enterprise Module for Web Scripting 15-SP4:
zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP4-2023-419=1
Package List:
- openSUSE Leap 15.5 (aarch64 s390x x86_64):
corepack18-18.13.0-150400.9.3.1
nodejs18-18.13.0-150400.9.3.1
nodejs18-debuginfo-18.13.0-150400.9.3.1
nodejs18-debugsource-18.13.0-150400.9.3.1
nodejs18-devel-18.13.0-150400.9.3.1
npm18-18.13.0-150400.9.3.1
- openSUSE Leap 15.5 (noarch):
nodejs18-docs-18.13.0-150400.9.3.1
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
corepack18-18.13.0-150400.9.3.1
nodejs18-18.13.0-150400.9.3.1
nodejs18-debuginfo-18.13.0-150400.9.3.1
nodejs18-debugsource-18.13.0-150400.9.3.1
nodejs18-devel-18.13.0-150400.9.3.1
npm18-18.13.0-150400.9.3.1
- openSUSE Leap 15.4 (noarch):
nodejs18-docs-18.13.0-150400.9.3.1
- SUSE Linux Enterprise Module for Web Scripting 15-SP4 (aarch64 ppc64le s390x x86_64):
nodejs18-18.13.0-150400.9.3.1
nodejs18-debuginfo-18.13.0-150400.9.3.1
nodejs18-debugsource-18.13.0-150400.9.3.1
nodejs18-devel-18.13.0-150400.9.3.1
npm18-18.13.0-150400.9.3.1
- SUSE Linux Enterprise Module for Web Scripting 15-SP4 (noarch):
nodejs18-docs-18.13.0-150400.9.3.1
References:
https://www.suse.com/security/cve/CVE-2022-32212.html
https://www.suse.com/security/cve/CVE-2022-32213.html
https://www.suse.com/security/cve/CVE-2022-32214.html
https://www.suse.com/security/cve/CVE-2022-32215.html
https://www.suse.com/security/cve/CVE-2022-35255.html
https://www.suse.com/security/cve/CVE-2022-35256.html
https://www.suse.com/security/cve/CVE-2022-43548.html
https://bugzilla.suse.com/1200303
https://bugzilla.suse.com/1201325
https://bugzilla.suse.com/1201326
https://bugzilla.suse.com/1201327
https://bugzilla.suse.com/1201328
https://bugzilla.suse.com/1203831
https://bugzilla.suse.com/1203832
https://bugzilla.suse.com/1205042
https://bugzilla.suse.com/1205119
https://bugzilla.suse.com/1205236
A nodejs18 security update has been released for SUSE Linux Enterprise and openSUSE Leap 15.4/15.5.
