SUSE-SU-2023:0419-1: moderate: Security update for nodejs18

sle-security-updates at lists.suse.com sle-security-updates at lists.suse.com
Wed Feb 15 14:28:36 UTC 2023


   SUSE Security Update: Security update for nodejs18
______________________________________________________________________________

Announcement ID:    SUSE-SU-2023:0419-1
Rating:             moderate
References:         #1200303 #1201325 #1201326 #1201327 #1201328 
                    #1203831 #1203832 #1205042 #1205119 #1205236 
                    PED-2097 PED-3192 
Cross-References:   CVE-2022-32212 CVE-2022-32213 CVE-2022-32214
                    CVE-2022-32215 CVE-2022-35255 CVE-2022-35256
                    CVE-2022-43548
CVSS scores:
                    CVE-2022-32212 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-32212 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
                    CVE-2022-32213 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
                    CVE-2022-32213 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
                    CVE-2022-32214 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
                    CVE-2022-32214 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
                    CVE-2022-32215 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
                    CVE-2022-32215 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
                    CVE-2022-35255 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
                    CVE-2022-35255 (SUSE): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
                    CVE-2022-35256 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
                    CVE-2022-35256 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
                    CVE-2022-43548 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-43548 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products:
                    SUSE Linux Enterprise High Performance Computing 15-SP4
                    SUSE Linux Enterprise Module for Web Scripting 15-SP4
                    SUSE Linux Enterprise Server 15-SP4
                    SUSE Linux Enterprise Server for SAP Applications 15-SP4
                    SUSE Manager Proxy 4.3
                    SUSE Manager Retail Branch Server 4.3
                    SUSE Manager Server 4.3
                    openSUSE Leap 15.4
                    openSUSE Leap 15.5
______________________________________________________________________________

   An update that solves 7 vulnerabilities, contains two
   features and has three fixes is now available.

Description:

   This update for nodejs18 fixes the following issues:

   This update ships nodejs18 (jsc#PED-2097)

   Update to NodejJS 18.13.0 LTS:

   * build: disable v8 snapshot compression by default
   * crypto: update root certificates
   * deps: update ICU to 72.1
   * doc:

     + add doc-only deprecation for headers/trailers setters
     + add Rafael to the tsc
     + deprecate use of invalid ports in url.parse
     + deprecate url.parse()

   * lib: drop fetch experimental warning
   * net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options
   * src:

     + add uvwasi version
     + add initial shadow realm support

   * test_runner:

     + add t.after() hook
     + don't use a symbol for runHook()

   * tls:

     + add "ca" property to certificate object

   * util:

     + add fast path for utf8 encoding
     + improve textdecoder decode performance
     + add MIME utilities

   - Fixes compatibility with ICU 72.1 (bsc#1205236)
   - Fix migration to openssl-3 (bsc#1205042)

   Update to NodeJS 18.12.1 LTS:

   * inspector: DNS rebinding in --inspect via invalid octal IP (bsc#1205119,
     CVE-2022-43548)

   Update to NodeJS 18.12.0 LTS:

   * Running in 'watch' mode using node --watch restarts the process when an
     imported file is changed.
   * fs: add FileHandle.prototype.readLines
   * http: add writeEarlyHints function to ServerResponse
   * http2: make early hints generic
   * util: add default value option to parsearg

   Update to NodeJS 18.11.0:

   * added experimental watch mode -- running in 'watch' mode using node
     --watch restarts the process when an imported file is changed
   * fs: add FileHandle.prototype.readLines
   * http: add writeEarlyHints function to ServerResponse
   * http2: make early hints generic
   * lib: refactor transferable AbortSignal
   * src: add detailed embedder process initialization API
   * util: add default value option to parsearg

   Update to NodeJS 18.10.0:

   * deps: upgrade npm to 8.19.2
   * http: throw error on content-length mismatch
   * stream: add ReadableByteStream.tee()

   Update to Nodejs 18.9.1:

   * deps: llhttp updated to 6.0.10

     + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
     + Incorrect Parsing of Multi-line Transfer-Encoding (CVE-2022-32215,
       bsc#1201327)
     + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)

   * crypto: fix weak randomness in WebCrypto keygen (CVE-2022-35255,
     bsc#1203831)

   Update to Nodejs 18.9.0:

   * lib - add diagnostics channel for process and worker
   * os - add machine method
   * report - expose report public native apis
   * src - expose environment RequestInterrupt api
   * vm - include vm context in the embedded snapshot

   Changes in 18.8.0:

   * bootstrap: implement run-time user-land snapshots via
     --build-snapshot and --snapshot-blob. See
   * crypto:
     + allow zero-length IKM in HKDF and in webcrypto PBKDF2
     + allow zero-length secret KeyObject
   * deps: upgrade npm to 8.18.0
   * http: make idle http parser count configurable
   * net: add local family
   * src: print source map error source on demand
   * tls: pass a valid socket on tlsClientError

   Update to Nodejs 18.7.0:

   * events: add CustomEvent
   * http: add drop request event for http server
   * lib: improved diagnostics_channel subscribe/unsubscribe
   * util: add tokens to parseArgs

   - enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)

   Update to Nodejs 18.6.0:

   * Experimental ESM Loader Hooks API. For details see,
     https://nodejs.org/api/esm.html
   * dns: export error code constants from dns/promises
   * esm: add chaining to loaders
   * http: add diagnostics channel for http client
   * http: add perf_hooks detail for http request and client
   * module: add isBuiltIn method
   * net: add drop event for net server
   * test_runner: expose describe and it
   * v8: add v8.startupSnapshot utils

   For details, see
   https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18
   .6.0

   Update to Nodejs 18.5.0:

   * http: stricter Transfer-Encoding and header separator parsing
     (bsc#1201325, bsc#1201326, bsc#1201327, CVE-2022-32213, CVE-2022-32214,
     CVE-2022-32215)
   * src: fix IPv4 validation in inspector_socket (bsc#1201328,
     CVE-2022-32212)

   For details, see
   https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18
   .5.0

   Update to Nodejs 18.4.0. For detailed changes see,

   https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18
   .4.0

   Initial packaging of Nodejs 18.2.0. For detailed changes since previous
   versions, see
   https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V18.md#
   18.2.0


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.5:

      zypper in -t patch openSUSE-SLE-15.5-2023-419=1

   - openSUSE Leap 15.4:

      zypper in -t patch openSUSE-SLE-15.4-2023-419=1

   - SUSE Linux Enterprise Module for Web Scripting 15-SP4:

      zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP4-2023-419=1



Package List:

   - openSUSE Leap 15.5 (aarch64 s390x x86_64):

      corepack18-18.13.0-150400.9.3.1
      nodejs18-18.13.0-150400.9.3.1
      nodejs18-debuginfo-18.13.0-150400.9.3.1
      nodejs18-debugsource-18.13.0-150400.9.3.1
      nodejs18-devel-18.13.0-150400.9.3.1
      npm18-18.13.0-150400.9.3.1

   - openSUSE Leap 15.5 (noarch):

      nodejs18-docs-18.13.0-150400.9.3.1

   - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):

      corepack18-18.13.0-150400.9.3.1
      nodejs18-18.13.0-150400.9.3.1
      nodejs18-debuginfo-18.13.0-150400.9.3.1
      nodejs18-debugsource-18.13.0-150400.9.3.1
      nodejs18-devel-18.13.0-150400.9.3.1
      npm18-18.13.0-150400.9.3.1

   - openSUSE Leap 15.4 (noarch):

      nodejs18-docs-18.13.0-150400.9.3.1

   - SUSE Linux Enterprise Module for Web Scripting 15-SP4 (aarch64 ppc64le s390x x86_64):

      nodejs18-18.13.0-150400.9.3.1
      nodejs18-debuginfo-18.13.0-150400.9.3.1
      nodejs18-debugsource-18.13.0-150400.9.3.1
      nodejs18-devel-18.13.0-150400.9.3.1
      npm18-18.13.0-150400.9.3.1

   - SUSE Linux Enterprise Module for Web Scripting 15-SP4 (noarch):

      nodejs18-docs-18.13.0-150400.9.3.1


References:

   https://www.suse.com/security/cve/CVE-2022-32212.html
   https://www.suse.com/security/cve/CVE-2022-32213.html
   https://www.suse.com/security/cve/CVE-2022-32214.html
   https://www.suse.com/security/cve/CVE-2022-32215.html
   https://www.suse.com/security/cve/CVE-2022-35255.html
   https://www.suse.com/security/cve/CVE-2022-35256.html
   https://www.suse.com/security/cve/CVE-2022-43548.html
   https://bugzilla.suse.com/1200303
   https://bugzilla.suse.com/1201325
   https://bugzilla.suse.com/1201326
   https://bugzilla.suse.com/1201327
   https://bugzilla.suse.com/1201328
   https://bugzilla.suse.com/1203831
   https://bugzilla.suse.com/1203832
   https://bugzilla.suse.com/1205042
   https://bugzilla.suse.com/1205119
   https://bugzilla.suse.com/1205236



More information about the sle-security-updates mailing list