SUSE-CU-2024:749-1: Security update of bci/nodejs

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/nodejs
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2024:749-1
Container Tags        : bci/node:20 , bci/node:20-6.12 , bci/node:latest , bci/nodejs:20 , bci/nodejs:20-6.12 , bci/nodejs:latest
Container Release     : 6.12
Severity              : important
Type                  : security
References            : 1219152 1219724 1219992 1219993 1219994 1219995 1219997 1219998
                        1219999 1220014 1220017 CVE-2023-46809 CVE-2024-21890 CVE-2024-21891
                        CVE-2024-21892 CVE-2024-21896 CVE-2024-22017 CVE-2024-22019 CVE-2024-22025
                        CVE-2024-24758 CVE-2024-24806 
-----------------------------------------------------------------

The container bci/nodejs was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:643-1
Released:    Wed Feb 28 09:43:41 2024
Summary:     Security update for nodejs20
Type:        security
Severity:    important
References:  1219152,1219724,1219992,1219993,1219994,1219995,1219997,1219998,1219999,1220014,1220017,CVE-2023-46809,CVE-2024-21890,CVE-2024-21891,CVE-2024-21892,CVE-2024-21896,CVE-2024-22017,CVE-2024-22019,CVE-2024-22025,CVE-2024-24758,CVE-2024-24806
This update for nodejs20 fixes the following issues:

Update to 20.11.1: (security updates)

* CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).
* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).
* CVE-2024-21896: Path traversal by monkey-patching Buffer internals (bsc#1219994).j
* CVE-2024-22017: setuid() does not drop all privileges due to io_uring (bsc#1219995).
* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).
* CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization (bsc#1219998).
* CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write (bsc#1219999).
* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).
* CVE-2024-24758: undici version 5.28.3 (bsc#1220017).
* CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).

Update to 20.11.0:

* esm: add import.meta.dirname and import.meta.filename
* fs: add c++ fast path for writeFileSync utf8
* module: remove useCustomLoadersIfPresent flag
* module: bootstrap module loaders in shadow realm
* src: add --disable-warning option
* src: create per isolate proxy env template
* src: make process binding data weak
* stream: use Array for Readable buffer
* stream: optimize creation
* test_runner: adds built in lcov reporter
* test_runner: add Date to the supported mock APIs
* test_runner, cli: add --test-timeout flag

Update to 20.10.0:

* --experimental-default-type flag to flip module defaults
* The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected.
* Added flush option in file system functions for fs.writeFile functions
* Added experimental WebSocket client
* vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script


The following package changes have been done:

- nodejs20-20.11.1-150500.11.6.1 updated
- npm20-20.11.1-150500.11.6.1 updated