SUSE-CU-2023:3423-1: Security update of bci/nodejs
sle-security-updates at lists.suse.com
sle-security-updates at lists.suse.com
Tue Oct 17 07:07:07 UTC 2023
SUSE Container Update Advisory: bci/nodejs
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2023:3423-1
Container Tags : bci/node:16 , bci/node:16-18.3 , bci/nodejs:16 , bci/nodejs:16-18.3
Container Release : 18.3
Severity : important
Type : security
References : 1186606 1194038 1194609 1194900 1195391 1201519 1201627 1204844
1205161 1206627 1207534 1207778 1208194 1208721 1209229 1209741
1210004 1210702 1210999 1211078 1211407 1211418 1211419 1211576
1211604 1211605 1211606 1211607 1211828 1211829 1212260 1212434
1212574 1212579 1212581 1212582 1212583 1212623 1212819 1212910
1213185 1213189 1213237 1213240 1213487 1213514 1213517 1213575
1213853 1213873 1214052 1214054 1214140 1214150 1214154 1214156
1214768 1214806 1215026 1215533 1215713 1215888 1215889 CVE-2022-41409
CVE-2022-4304 CVE-2023-22652 CVE-2023-2602 CVE-2023-2603 CVE-2023-30078
CVE-2023-30079 CVE-2023-30581 CVE-2023-30585 CVE-2023-30588 CVE-2023-30589
CVE-2023-30590 CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-31484
CVE-2023-32001 CVE-2023-32002 CVE-2023-32006 CVE-2023-32067 CVE-2023-32181
CVE-2023-32559 CVE-2023-3446 CVE-2023-35945 CVE-2023-36054 CVE-2023-38039
CVE-2023-3817 CVE-2023-38545 CVE-2023-38546 CVE-2023-39615 CVE-2023-4039
CVE-2023-4641
-----------------------------------------------------------------
The container bci/nodejs was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2625-1
Released: Fri Jun 23 17:16:11 2023
Summary: Recommended update for gcc12
Type: recommended
Severity: moderate
References:
This update for gcc12 fixes the following issues:
- Update to GCC 12.3 release, 0c61aa720e62f1baf0bfd178e283, git1204
* includes regression and other bug fixes
- Speed up builds with --enable-link-serialization.
- Update embedded newlib to version 4.2.0
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2648-1
Released: Tue Jun 27 09:52:35 2023
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1201627,1207534,CVE-2022-4304
This update for openssl-1_1 fixes the following issues:
- CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption.
The previous fix for this timing side channel turned out to cause a
severe 2-3x performance regression in the typical use case (bsc#1207534).
- Update further expiring certificates that affect the testsuite (bsc#1201627).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2663-1
Released: Tue Jun 27 20:27:00 2023
Summary: Security update for nodejs16
Type: security
Severity: important
References: 1211407,1211604,1211605,1211606,1211607,1212574,1212579,1212581,1212582,1212583,CVE-2023-30581,CVE-2023-30585,CVE-2023-30588,CVE-2023-30589,CVE-2023-30590,CVE-2023-31124,CVE-2023-31130,CVE-2023-31147,CVE-2023-32067
This update for nodejs16 fixes the following issues:
Update to version 16.20.1:
- CVE-2023-30581: Fixed mainModule.__proto__ Bypass Experimental Policy Mechanism (bsc#1212574).
- CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (bsc#1212579).
- CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates (bsc#1212581).
- CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
- CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
- CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE (bsc#1211607).
- CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
- CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
- CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).
Bug fixes:
- Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build failures on some platforms, like s390x in Factory. (bsc#1211407)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2765-1
Released: Mon Jul 3 20:28:14 2023
Summary: Security update for libcap
Type: security
Severity: moderate
References: 1211418,1211419,CVE-2023-2602,CVE-2023-2603
This update for libcap fixes the following issues:
- CVE-2023-2602: Fixed improper memory release in libcap/psx/psx.c:__wrap_pthread_create() (bsc#1211418).
- CVE-2023-2603: Fixed an integer overflow or wraparound in libcap/cap_alloc.c:_libcap_strdup() (bsc#1211419).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2800-1
Released: Mon Jul 10 07:35:22 2023
Summary: Recommended update for openssl-1_1
Type: recommended
Severity: moderate
References: 1212623
This update for openssl-1_1 fixes the following issues:
- Check the OCSP RESPONSE in openssl s_client command and terminate
connection if a revoked certificate is found. [bsc#1212623]
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2827-1
Released: Fri Jul 14 11:27:47 2023
Summary: Recommended update for libxml2
Type: recommended
Severity: moderate
References:
This update for libxml2 fixes the following issues:
- Build also for modern python version (jsc#PED-68)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2847-1
Released: Mon Jul 17 08:40:42 2023
Summary: Recommended update for audit
Type: recommended
Severity: moderate
References: 1210004
This update for audit fixes the following issues:
- Check for AF_UNIX unnamed sockets (bsc#1210004)
- Enable livepatching on main library on x86_64
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2855-1
Released: Mon Jul 17 16:35:21 2023
Summary: Recommended update for openldap2
Type: recommended
Severity: moderate
References: 1212260
This update for openldap2 fixes the following issues:
- libldap2 crashes on ldap_sasl_bind_s (bsc#1212260)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2882-1
Released: Wed Jul 19 11:49:39 2023
Summary: Security update for perl
Type: security
Severity: important
References: 1210999,CVE-2023-31484
This update for perl fixes the following issues:
- CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:2885-1
Released: Wed Jul 19 16:58:43 2023
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1208721,1209229,1211828
This update for glibc fixes the following issues:
- getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235)
- Exclude static archives from preparation for live patching (bsc#1208721)
- resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2891-1
Released: Wed Jul 19 21:14:33 2023
Summary: Security update for curl
Type: security
Severity: moderate
References: 1213237,CVE-2023-32001
This update for curl fixes the following issues:
- CVE-2023-32001: Fixed TOCTOU race condition (bsc#1213237).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2962-1
Released: Tue Jul 25 09:34:53 2023
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1213487,CVE-2023-3446
This update for openssl-1_1 fixes the following issues:
- CVE-2023-3446: Fixed DH_check() excessive time with over sized modulus (bsc#1213487).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3285-1
Released: Fri Aug 11 10:30:38 2023
Summary: Recommended update for shadow
Type: recommended
Severity: moderate
References: 1206627,1213189
This update for shadow fixes the following issues:
- Prevent lock files from remaining after power interruptions (bsc#1213189)
- Add --prefix support to passwd, chpasswd and chage (bsc#1206627)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3286-1
Released: Fri Aug 11 10:32:03 2023
Summary: Recommended update for util-linux
Type: recommended
Severity: moderate
References: 1194038,1194900
This update for util-linux fixes the following issues:
- Fix blkid for floppy drives (bsc#1194900)
- Fix rpmbuild %checks fail when @ in the directory path (bsc#1194038)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3327-1
Released: Wed Aug 16 08:45:25 2023
Summary: Security update for pcre2
Type: security
Severity: moderate
References: 1213514,CVE-2022-41409
This update for pcre2 fixes the following issues:
- CVE-2022-41409: Fixed integer overflow vulnerability in pcre2test that allows attackers to cause a denial of service via negative input (bsc#1213514).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3363-1
Released: Fri Aug 18 14:54:16 2023
Summary: Security update for krb5
Type: security
Severity: important
References: 1214054,CVE-2023-36054
This update for krb5 fixes the following issues:
- CVE-2023-36054: Fixed a DoS that could be triggered by an authenticated remote user. (bsc#1214054)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3379-1
Released: Tue Aug 22 18:36:01 2023
Summary: Security update for nodejs16
Type: security
Severity: important
References: 1214150,1214154,1214156,CVE-2023-32002,CVE-2023-32006,CVE-2023-32559
This update for nodejs16 fixes the following issues:
Update to LTS version 16.20.2.
- CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150).
- CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156).
- CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3397-1
Released: Wed Aug 23 18:35:56 2023
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1213517,1213853,CVE-2023-3817
This update for openssl-1_1 fixes the following issues:
- CVE-2023-3817: Fixed a potential DoS due to excessive time spent checking DH q parameter value. (bsc#1213853)
- Don't pass zero length input to EVP_Cipher because s390x assembler optimized AES cannot handle zero size. (bsc#1213517)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3410-1
Released: Thu Aug 24 06:56:32 2023
Summary: Recommended update for audit
Type: recommended
Severity: moderate
References: 1201519,1204844
This update for audit fixes the following issues:
- Create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519)
- Fix rules not loaded when restarting auditd.service (bsc#1204844)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3451-1
Released: Mon Aug 28 12:15:22 2023
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1186606,1194609,1208194,1209741,1210702,1211576,1212434,1213185,1213575,1213873
This update for systemd fixes the following issues:
- Fix reboot and shutdown issues by getting only active MD arrays (bsc#1211576, bsc#1212434, bsc#1213575)
- Decrease devlink priority for iso disks (bsc#1213185)
- Do not ignore mount point paths longer than 255 characters (bsc#1208194)
- Refuse hibernation if there's no possible way to resume (bsc#1186606)
- Update 'korean' and 'arabic' keyboard layouts (bsc#1210702)
- Drop some entries no longer needed by YaST (bsc#1194609)
- The 'systemd --user' instances get their own session keyring instead of the user default one (bsc#1209741)
- Dynamically allocate receive buffer to handle large amount of mounts (bsc#1213873)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3611-1
Released: Fri Sep 15 09:28:36 2023
Summary: Recommended update for sysuser-tools
Type: recommended
Severity: moderate
References: 1195391,1205161,1207778,1213240,1214140
This update for sysuser-tools fixes the following issues:
- Update to version 3.2
- Always create a system group of the same name as the system user (bsc#1205161, bsc#1207778, bsc#1213240)
- Add 'quilt setup' friendly hint to %sysusers_requires usage
- Use append so if a pre file already exists it isn't overridden
- Invoke bash for bash scripts (bsc#1195391)
- Remove all systemd requires not supported on SLE15 (bsc#1214140)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3661-1
Released: Mon Sep 18 21:44:09 2023
Summary: Security update for gcc12
Type: security
Severity: important
References: 1214052,CVE-2023-4039
This update for gcc12 fixes the following issues:
- CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3699-1
Released: Wed Sep 20 11:02:50 2023
Summary: Security update for libxml2
Type: security
Severity: important
References: 1214768,CVE-2023-39615
This update for libxml2 fixes the following issues:
- CVE-2023-39615: Fixed crafted xml can cause global buffer overflow (bsc#1214768).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3814-1
Released: Wed Sep 27 18:08:17 2023
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1211829,1212819,1212910
This update for glibc fixes the following issues:
- nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415)
- Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457)
- elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688)
- elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676)
- ld.so: Always use MAP_COPY to map the first segment (BZ #30452)
- add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3823-1
Released: Wed Sep 27 18:42:38 2023
Summary: Security update for curl
Type: security
Severity: important
References: 1215026,CVE-2023-38039
This update for curl fixes the following issues:
- CVE-2023-38039: Fixed possible DoS when receiving too large HTTP header. (bsc#1215026)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3954-1
Released: Tue Oct 3 20:09:47 2023
Summary: Security update for libeconf
Type: security
Severity: important
References: 1211078,CVE-2023-22652,CVE-2023-30078,CVE-2023-30079,CVE-2023-32181
This update for libeconf fixes the following issues:
Update to version 0.5.2.
- CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in 'econf_writeFile' function (bsc#1211078).
- CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in 'read_file' function. (bsc#1211078)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:3994-1
Released: Fri Oct 6 13:44:15 2023
Summary: Recommended update for git
Type: recommended
Severity: moderate
References: 1215533
This update for git fixes the following issues:
- Downgrade openssh dependency to recommends (bsc#1215533)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3997-1
Released: Fri Oct 6 14:13:56 2023
Summary: Security update for nghttp2
Type: security
Severity: important
References: 1215713,CVE-2023-35945
This update for nghttp2 fixes the following issues:
- CVE-2023-35945: Fixed memory leak when PUSH_PROMISE or HEADERS frame cannot be sent (bsc#1215713).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4024-1
Released: Tue Oct 10 13:24:40 2023
Summary: Security update for shadow
Type: security
Severity: low
References: 1214806,CVE-2023-4641
This update for shadow fixes the following issues:
- CVE-2023-4641: Fixed potential password leak (bsc#1214806).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4044-1
Released: Wed Oct 11 09:01:14 2023
Summary: Security update for curl
Type: security
Severity: important
References: 1215888,1215889,CVE-2023-38545,CVE-2023-38546
This update for curl fixes the following issues:
- CVE-2023-38545: Fixed a heap buffer overflow in SOCKS5. (bsc#1215888)
- CVE-2023-38546: Fixed a cookie injection with none file. (bsc#1215889)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4073-1
Released: Fri Oct 13 11:40:26 2023
Summary: Recommended update for rpm
Type: recommended
Severity: low
References:
This update for rpm fixes the following issue:
- Enables build for all python modules (jsc#PED-68, jsc#PED-1988)
The following package changes have been done:
- libldap-data-2.4.46-150200.14.17.1 updated
- glibc-2.31-150300.58.1 updated
- perl-base-5.26.1-150300.17.14.1 updated
- libnghttp2-14-1.40.0-150200.9.1 updated
- libuuid1-2.37.2-150400.8.20.1 updated
- libsmartcols1-2.37.2-150400.8.20.1 updated
- libeconf0-0.5.2-150400.3.6.1 updated
- libcap2-2.63-150400.3.3.1 updated
- libblkid1-2.37.2-150400.8.20.1 updated
- libaudit1-3.0.6-150400.4.13.1 updated
- libfdisk1-2.37.2-150400.8.20.1 updated
- libgcc_s1-12.3.0+git1204-150000.1.16.1 updated
- libstdc++6-12.3.0+git1204-150000.1.16.1 updated
- libxml2-2-2.9.14-150400.5.22.1 updated
- libsystemd0-249.16-150400.8.33.1 updated
- libopenssl1_1-1.1.1l-150400.7.53.1 updated
- libopenssl1_1-hmac-1.1.1l-150400.7.53.1 updated
- libldap-2_4-2-2.4.46-150200.14.17.1 updated
- libmount1-2.37.2-150400.8.20.1 updated
- krb5-1.19.2-150400.3.6.1 updated
- login_defs-4.8.1-150400.10.12.1 updated
- libcurl4-8.0.1-150400.5.32.1 updated
- rpm-ndb-4.14.3-150400.59.3.1 updated
- shadow-4.8.1-150400.10.12.1 updated
- sysuser-shadow-3.2-150400.3.5.3 updated
- util-linux-2.37.2-150400.8.20.1 updated
- libpcre2-8-0-10.39-150400.4.9.1 updated
- nodejs16-16.20.2-150400.3.24.1 updated
- npm16-16.20.2-150400.3.24.1 updated
- git-core-2.35.3-150300.10.30.1 updated
- container:sles15-image-15.0.0-27.14.107 updated
- libcbor0-0.5.0-150100.4.6.1 removed
- libedit0-3.1.snap20150325-2.12 removed
- libfido2-1-1.5.0-1.30 removed
- libfido2-udev-1.5.0-1.30 removed
- libudev1-249.16-150400.8.28.3 removed
- openssh-clients-8.4p1-150300.3.18.2 removed
- openssh-common-8.4p1-150300.3.18.2 removed
- openssh-fips-8.4p1-150300.3.18.2 removed
More information about the sle-security-updates
mailing list