SUSE-CU-2023:745-1: Security update of bci/nodejs

Tue Mar 21 08:03:43 UTC 2023

SUSE Container Update Advisory: bci/nodejs
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2023:745-1
Container Tags        : bci/node:18 , bci/node:18-3.5 , bci/node:latest , bci/nodejs:18 , bci/nodejs:18-3.5 , bci/nodejs:latest
Container Release     : 3.5
Severity              : important
Type                  : security
References            : 1208413 1208481 1208483 1208485 1208487 1208924 1208925 1208926
                        1208998 CVE-2023-23918 CVE-2023-23919 CVE-2023-23920 CVE-2023-23936
                        CVE-2023-24807 
-----------------------------------------------------------------

The container bci/nodejs was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:738-1
Released:    Wed Mar 15 08:17:45 2023
Summary:     Security update for nodejs18
Type:        security
Severity:    important
References:  1208413,1208481,1208483,1208485,1208487,CVE-2023-23918,CVE-2023-23919,CVE-2023-23920,CVE-2023-23936,CVE-2023-24807
This update for nodejs18 fixes the following issues:

Update to NodeJS 18.14.2 LTS:

- CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
- CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
- CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
- CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
- CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:776-1
Released:    Thu Mar 16 17:29:23 2023
Summary:     Recommended update for gcc12
Type:        recommended
Severity:    moderate
References:  
This update for gcc12 fixes the following issues:

This update ships gcc12 also to the SUSE Linux Enterprise 15 SP1 LTSS and 15 SP2 LTSS products.

SUSE Linux Enterprise 15 SP3 and SP4 get only refreshed builds without changes

This update ship the GCC 12 compiler suite and its base libraries.

The compiler baselibraries are provided for all SUSE Linux Enterprise 15
versions and replace the same named GCC 11 ones.

The new compilers for C, C++, and Fortran are provided in the SUSE Linux
Enterprise Module for Development Tools.

To use gcc12 compilers use:

- install 'gcc12' or 'gcc12-c++' or one of the other 'gcc12-COMPILER' frontend packages.
- override your makefile to use CC=gcc12, CXX=g++12 and similar overrides for the other languages.

For a full changelog with all new GCC12 features, check out

	https://gcc.gnu.org/gcc-12/changes.html

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:782-1
Released:    Thu Mar 16 19:08:34 2023
Summary:     Recommended update for libgcrypt
Type:        recommended
Severity:    moderate
References:  1208924,1208925,1208926
This update for libgcrypt fixes the following issues:

- FIPS: ECC: Transition to error-state if PCT fail [bsc#1208925]
- FIPS: ECDSA: Avoid no-keytest in ECDSA keygen [bsc#1208924]
- FIPS: PBKDF2: Added additional checks for the minimum key length,
  salt length, iteration count and passphrase length to the kdf
  FIPS indicator in _gcry_fips_indicator_kdf() [bsc#1208926]

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:783-1
Released:    Thu Mar 16 19:09:03 2023
Summary:     Recommended update for openssl-1_1
Type:        recommended
Severity:    moderate
References:  1208998
This update for openssl-1_1 fixes the following issues:

FIPS: Service-level indicator changes [bsc#1208998]

* Add additional checks required by FIPS 140-3. Minimum values for
  PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
  iteration count and 20 characters for password.

The following package changes have been done:

- libgcrypt20-1.9.4-150400.6.8.1 updated
- libgcrypt20-hmac-1.9.4-150400.6.8.1 updated
- libgcc_s1-12.2.1+git416-150000.1.7.1 updated
- libstdc++6-12.2.1+git416-150000.1.7.1 updated
- libopenssl1_1-1.1.1l-150400.7.28.1 updated
- libopenssl1_1-hmac-1.1.1l-150400.7.28.1 updated
- nodejs18-18.14.2-150400.9.6.2 updated
- npm18-18.14.2-150400.9.6.2 updated
- container:sles15-image-15.0.0-27.14.41 updated