SUSE-CU-2022:1550-1: Security update of bci/nodejs

[sle-security-updates at lists.suse.com]

SUSE Container Update Advisory: bci/nodejs
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2022:1550-1
Container Tags        : bci/node:14 , bci/node:14-13.17 , bci/nodejs:14 , bci/nodejs:14-13.17
Container Release     : 13.17
Severity              : important
Type                  : security
References            : 1197718 1199140 1199232 1199232 1200334 1200855 1201325 1201326
                        1201327 1201328 CVE-2022-1586 CVE-2022-1586 CVE-2022-32212 CVE-2022-32213
                        CVE-2022-32214 CVE-2022-32215 
-----------------------------------------------------------------

The container bci/nodejs was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2360-1
Released:    Tue Jul 12 12:01:39 2022
Summary:     Security update for pcre2
Type:        security
Severity:    important
References:  1199232,CVE-2022-1586
This update for pcre2 fixes the following issues:

- CVE-2022-1586: Fixed unicode property matching issue. (bsc#1199232)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2361-1
Released:    Tue Jul 12 12:05:01 2022
Summary:     Security update for pcre
Type:        security
Severity:    important
References:  1199232,CVE-2022-1586
This update for pcre fixes the following issues:

- CVE-2022-1586: Fixed unicode property matching issue. (bsc#1199232)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2406-1
Released:    Fri Jul 15 11:49:01 2022
Summary:     Recommended update for glibc
Type:        recommended
Severity:    moderate
References:  1197718,1199140,1200334,1200855
This update for glibc fixes the following issues:

- powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334)
- Disable warnings due to deprecated libselinux symbols used by nss and nscd (bsc#1197718)
- i386: Remove broken CAN_USE_REGISTER_ASM_EBP (bsc#1197718)
- rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051)

This readds the s390 32bit glibc and libcrypt1 libraries (glibc-32bit, glibc-locale-base-32bit, libcrypt1-32bit).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2425-1
Released:    Mon Jul 18 09:04:24 2022
Summary:     Security update for nodejs14
Type:        security
Severity:    important
References:  1201325,1201326,1201327,1201328,CVE-2022-32212,CVE-2022-32213,CVE-2022-32214,CVE-2022-32215
This update for nodejs14 fixes the following issues:

- CVE-2022-32212: Fixed DNS rebinding in --inspect via invalid IP addresses (bsc#1201328).
- CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding (bsc#1201325).
- CVE-2022-32214: Fixed HTTP request smuggling due to improper delimiting of header fields (bsc#1201326).
- CVE-2022-32215: Fixed HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (bsc#1201327).


The following package changes have been done:

- glibc-2.31-150300.31.2 updated
- libcrypt1-4.4.15-150300.4.4.3 updated
- libpcre1-8.45-150000.20.13.1 updated
- libpcre2-8-0-10.39-150400.4.3.1 updated
- nodejs14-14.20.0-150200.15.34.1 updated
- npm14-14.20.0-150200.15.34.1 updated
- container:sles15-image-15.0.0-27.8.6 updated